{"vulnerability": "CVE-2025-20029", "sightings": [{"uuid": "19c9c16a-8261-4356-90c5-e1ec7dcfbe9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/113953196776332903", "content": "", "creation_timestamp": "2025-02-05T20:36:33.074843Z"}, {"uuid": "c125103c-cea7-4312-8cb4-75d6e43e4191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lhhljgossz27", "content": "", "creation_timestamp": "2025-02-05T22:08:53.702011Z"}, {"uuid": "dbcd5551-4a57-4c87-8541-5d472471778e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113952492462136812", "content": "", "creation_timestamp": "2025-02-05T17:37:26.201887Z"}, {"uuid": "46e783cf-0253-47a2-b547-ee1bc6e35611", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lhh6jyudev2h", "content": "", "creation_timestamp": "2025-02-05T18:16:31.371808Z"}, {"uuid": "da4a5066-5009-4fde-bbde-a161aadd5c9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://mastodon.social/users/CyberSignaler/statuses/113952771259642555", "content": "", "creation_timestamp": "2025-02-05T18:48:34.026514Z"}, {"uuid": "8736ec8f-dd4f-4dae-aba2-b8b5646153e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://bsky.app/profile/dinosn.bsky.social/post/3lj4x5p4koc2k", "content": "", "creation_timestamp": "2025-02-27T03:28:12.222230Z"}, {"uuid": "022c55cb-a4a8-4e1d-a359-09acbaeddaf9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lj5b53hxly2m", "content": "", "creation_timestamp": "2025-02-27T06:26:46.251864Z"}, {"uuid": "55deb8cb-2c5d-4f0c-a8db-326100c8b443", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-20029", "type": "seen", "source": "https://bsky.app/profile/kyosuke-tanaka.bsky.social/post/3lj5iu6k7zk2w", "content": "", "creation_timestamp": "2025-02-27T08:44:56.569744Z"}, {"uuid": "12b047b2-ae4a-419a-9ea5-54d970fe7e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://bsky.app/profile/bolhasec.com/post/3ljqdjoicut2c", "content": "", "creation_timestamp": "2025-03-06T20:30:10.895649Z"}, {"uuid": "affa1b8b-2806-4c43-8f26-2afa2ac4c544", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://bsky.app/profile/andranglin.bsky.social/post/3lj6lviv7kk2m", "content": "", "creation_timestamp": "2025-02-27T19:12:05.183314Z"}, {"uuid": "7d139268-4319-4359-89f3-31d2972aa64d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "MISP/4937e86f-f5bd-4d09-8bda-88a7440077f3", "content": "", "creation_timestamp": "2025-08-18T13:31:23.000000Z"}, {"uuid": "0165f89c-d6b8-4080-a013-b520a17b89ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "MISP/4937e86f-f5bd-4d09-8bda-88a7440077f3", "content": "", "creation_timestamp": "2025-08-19T02:47:45.000000Z"}, {"uuid": "545cc74c-9858-4ee2-ae36-b722c64f82f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/15093", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aCVE-2025-20029: Command Injection in TMSH CLI in F5 BIG-IP\nURL\uff1ahttps://github.com/mbadanoiu/CVE-2025-20029\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-02-23T19:02:21.000000Z"}, {"uuid": "f855f456-97a1-4783-bfec-6cc4e097af76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/5456", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-20029\n\ud83d\udd25 CVSS Score: 8.8 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)\n\ud83d\udd39 Description: Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands.\n\n \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.\n\ud83d\udccf Published: 2025-02-05T17:31:06.455Z\n\ud83d\udccf Modified: 2025-02-26T04:55:26.913Z\n\ud83d\udd17 References:\n1. https://my.f5.com/manage/s/article/K000148587", "creation_timestamp": "2025-02-26T05:26:38.000000Z"}, {"uuid": "42ab1942-5324-42a6-aec6-da5e520d35ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/35132", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aSimulated environment for CVE-2025-20029 using Docker. Includes PoC and auto-reporting.\nURL\uff1ahttps://github.com/schoi1337/CVE-2025-20029-simulation\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-05-01T06:00:25.000000Z"}, {"uuid": "f839ecc1-836d-405b-a882-11ecdf787cd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "published-proof-of-concept", "source": "https://t.me/CyberBulletin/2419", "content": "\u26a1CVE-2025-20029: Command Injection Flaw Discovered in F5 BIG-IP System, PoC Releases.\n\n#CyberBulletin", "creation_timestamp": "2025-02-28T04:57:07.000000Z"}, {"uuid": "2ad4a3f6-6a07-44e0-8920-f75e5ff628e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "published-proof-of-concept", "source": "https://t.me/ton618cyber/2585", "content": "#exploit\n1. CVE-2025-20029:\nCommand Injection in TMSH CLI in F5 BIG-IP\nhttps://github.com/mbadanoiu/CVE-2025-20029\n\n2. Dropping a 0 day:\nParallels Desktop Repack Root Privilege Escalation (CVE-2024-34331)\nhttps://jhftss.github.io/Parallels-0-day\n\n3. CVE-2025-21669/CVE-2025-21670:\nvsock/virtio: discard packets if the transport changes / vsock/bpf: return early if transport is not assigned (Linux Kernel)\nhttps://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html", "creation_timestamp": "2025-02-28T07:48:31.000000Z"}, {"uuid": "0a1c2613-b40a-40eb-8fd0-665d9e5dfddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "published-proof-of-concept", "source": "Telegram/Z0ari8MHZAzBUd7K9yxhwtBySsURYEVG61pidF9swyP9zTE", "content": "", "creation_timestamp": "2025-05-01T13:00:06.000000Z"}, {"uuid": "b068e8ff-9fab-413e-8ac6-e1db0375c8dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "published-proof-of-concept", "source": "Telegram/iKE-ifN8C4jbKlxJZm9dPRBcrWriwuOpiCrJGZ4kRda8BQ8", "content": "", "creation_timestamp": "2025-02-24T04:00:07.000000Z"}, {"uuid": "c18c0b05-8367-40e9-9c0f-4ec119992c6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://t.me/purp_sec/316", "content": "\u0421\u043e\u0431\u0440\u0430\u043b \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e CVE, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435.\n\n\ud83d\udd35CVE-2024-49035 \u0438 CVE-2023-34192 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Partner Center \u0438 Synacor Zimbra Collaboration Suite (ZCS). \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a \u043d\u0438\u043c \u0432\u044b\u0448\u043b\u0438 \u0432 2024 \u0438 2023 \u0433\u043e\u0434\u0430\u0445 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, CISA \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043b\u0430 \u0438\u0445 \u043a\u0430\u043a \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435.\n\n\ud83d\udd35CVE-2025-20029 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 F5 BIG-IP, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043c\u0430\u043d\u0434 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f iControl REST API \u0438 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 BIG-IP TMOS (tmsh). \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u043d\u0438\u0437\u043a\u0438\u043c \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c\u0438 \u0444\u0430\u0439\u043b\u0430\u043c\u0438.\n\n\ud83d\udd35CVE-2025-20111 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 Nexus \u043e\u0442 Cisco. \u0421\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u044d\u0442\u043e\u0439 CVE, \u0437\u0430\u043a\u0438\u0434\u0430\u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 Ethernet-\u0444\u0440\u0435\u0439\u043c\u0430\u043c\u0438 \u043d\u0430 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u0438. \u0412 \u0438\u0442\u043e\u0433\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0441\u044f \u0432 \u0440\u0435\u0431\u0443\u0442.\n\n\ud83d\udd35CVE-2024-12084 \u2014 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043a\u0443\u0447\u0438 (heap-based buffer overflow) \u0432 \u0434\u0435\u043c\u043e\u043d\u0435 rsync. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c 48 \u0431\u0430\u0439\u0442\u043e\u0432 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 sum2 \u0432 \u0441\u043e\u0441\u0435\u0434\u043d\u044e\u044e \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u0438, \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430. \u0415\u0441\u043b\u0438 \u0430\u0442\u0430\u043a\u0443\u0435\u043c\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c rsync \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0433\u0443\u0442 \u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438.\n\n#blue_team #CVE_\u0434\u043d\u044f", "creation_timestamp": "2026-08-05T00:00:24.213388Z"}, {"uuid": "f74019b6-8509-4095-804e-ee0b2f299f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/11859", "content": "#exploit\n1. CVE-2025-20029:\nCommand Injection in TMSH CLI in F5 BIG-IP\nhttps://github.com/mbadanoiu/CVE-2025-20029\n\n2. Dropping a 0 day:\nParallels Desktop Repack Root Privilege Escalation (CVE-2024-34331)\nhttps://jhftss.github.io/Parallels-0-day\n\n3. CVE-2025-21669/CVE-2025-21670:\nvsock/virtio: discard packets if the transport changes / vsock/bpf: return early if transport is not assigned (Linux Kernel)\nhttps://u1f383.github.io/linux/2025/02/24/linux-kernel-some-vsock-vulnerabilities-analysis.html", "creation_timestamp": "2025-02-26T00:08:02.000000Z"}, {"uuid": "ba654053-865e-4387-a58d-9c015878a179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://t.me/purp_sec/316", "content": "\u0421\u043e\u0431\u0440\u0430\u043b \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e CVE, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0442\u043e\u0438\u0442 \u043e\u0431\u0440\u0430\u0442\u0438\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435.\n\n\ud83d\udd35CVE-2024-49035 \u0438 CVE-2023-34192 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Microsoft Partner Center \u0438 Synacor Zimbra Collaboration Suite (ZCS). \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a \u043d\u0438\u043c \u0432\u044b\u0448\u043b\u0438 \u0432 2024 \u0438 2023 \u0433\u043e\u0434\u0430\u0445 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u0442\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, CISA \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043b\u0430 \u0438\u0445 \u043a\u0430\u043a \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0435.\n\n\ud83d\udd35CVE-2025-20029 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 F5 BIG-IP, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043c\u0430\u043d\u0434 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f iControl REST API \u0438 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 BIG-IP TMOS (tmsh). \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u043d\u0438\u0437\u043a\u0438\u043c \u0443\u0440\u043e\u0432\u043d\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c\u0438 \u0444\u0430\u0439\u043b\u0430\u043c\u0438.\n\n\ud83d\udd35CVE-2025-20111 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u043e\u0432 Nexus \u043e\u0442 Cisco. \u0421\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u044d\u0442\u043e\u0439 CVE, \u0437\u0430\u043a\u0438\u0434\u0430\u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438 Ethernet-\u0444\u0440\u0435\u0439\u043c\u0430\u043c\u0438 \u043d\u0430 \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u0441\u043a\u043e\u0440\u043e\u0441\u0442\u0438. \u0412 \u0438\u0442\u043e\u0433\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0441\u044f \u0432 \u0440\u0435\u0431\u0443\u0442.\n\n\ud83d\udd35CVE-2024-12084 \u2014 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u043a\u0443\u0447\u0438 (heap-based buffer overflow) \u0432 \u0434\u0435\u043c\u043e\u043d\u0435 rsync. \u041f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c 48 \u0431\u0430\u0439\u0442\u043e\u0432 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 sum2 \u0432 \u0441\u043e\u0441\u0435\u0434\u043d\u044e\u044e \u043e\u0431\u043b\u0430\u0441\u0442\u044c \u043f\u0430\u043c\u044f\u0442\u0438, \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430. \u0415\u0441\u043b\u0438 \u0430\u0442\u0430\u043a\u0443\u0435\u043c\u044b\u0439 \u043c\u043e\u0434\u0443\u043b\u044c rsync \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0447\u0442\u0435\u043d\u0438\u0435, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0433\u0443\u0442 \u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438.\n\n#blue_team #CVE_\u0434\u043d\u044f", "creation_timestamp": "2026-08-04T13:00:09.800746Z"}, {"uuid": "63f17374-22d8-48e6-9879-4a8942c745f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://t.me/brutsecurity/1581", "content": "CVE-2025-20029: Command Injection in F5 BIG-IP, 8.8 rating\u2757\ufe0f\n\nThe vulnerability allows an attacker to escalate privileges, execute arbitrary commands, and manipulate system files. Not the latest vulnerability, but the PoC was published just recently!\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/e17gN\n\ud83d\udc49 Dork: http.headers.server:\"BigIP\"\n\nVendor's advisory: https://my.f5.com/manage/s/article/K000148587", "creation_timestamp": "2026-07-09T03:00:09.439757Z"}, {"uuid": "feb9eeaf-2af9-4923-96a9-e0c72de6d4c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://t.me/brutsecurity/1581", "content": "CVE-2025-20029: Command Injection in F5 BIG-IP, 8.8 rating\u2757\ufe0f\n\nThe vulnerability allows an attacker to escalate privileges, execute arbitrary commands, and manipulate system files. Not the latest vulnerability, but the PoC was published just recently!\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/e17gN\n\ud83d\udc49 Dork: http.headers.server:\"BigIP\"\n\nVendor's advisory: https://my.f5.com/manage/s/article/K000148587", "creation_timestamp": "2026-07-10T00:00:33.066805Z"}, {"uuid": "8892fdea-fd5b-40f5-8001-cda3044e4dae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "published-proof-of-concept", "source": "https://t.me/brutsecurity/1581", "content": "CVE-2025-20029: Command Injection in F5 BIG-IP, 8.8 rating\u2757\ufe0f\n\nThe vulnerability allows an attacker to escalate privileges, execute arbitrary commands, and manipulate system files. Not the latest vulnerability, but the PoC was published just recently!\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/e17gN\n\ud83d\udc49 Dork: http.headers.server:\"BigIP\"\n\nVendor's advisory: https://my.f5.com/manage/s/article/K000148587", "creation_timestamp": "2026-07-11T14:00:04.005012Z"}, {"uuid": "bfc3ff01-be59-410d-bcf7-c011e07ae3ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "published-proof-of-concept", "source": "https://t.me/brutsecurity/1581", "content": "CVE-2025-20029: Command Injection in F5 BIG-IP, 8.8 rating\u2757\ufe0f\n\nThe vulnerability allows an attacker to escalate privileges, execute arbitrary commands, and manipulate system files. Not the latest vulnerability, but the PoC was published just recently!\n\nSearch at Netlas.io:\n\ud83d\udc49 Link: https://nt.ls/e17gN\n\ud83d\udc49 Dork: http.headers.server:\"BigIP\"\n\nVendor's advisory: https://my.f5.com/manage/s/article/K000148587", "creation_timestamp": "2026-07-12T00:00:47.774258Z"}, {"uuid": "4db2545f-515b-4837-84ec-1e481a93e428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://t.me/cissp/7834", "content": "#Analytics\n#ThreatResearch\nAn analytical review of the main cybersecurity events for the 2025\n\n\u0632\u0646\u062f\u06af\u06cc \u062f\u06cc\u0648\u0627\u0646\u0647\u200c\u0648\u0627\u0631!\n\u0647\u0627\u0644\u0648\u0648\u06cc\u0646 \u06a9\u0647 \u0646\u0632\u062f\u06cc\u06a9 \u0648 \u200c\u0631\u062f \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062f\u0646\u06cc\u0627 \u0627\u0646\u06af\u0627\u0631 \u0686\u0647\u0631\u0647\u200c\u06cc \u0648\u0627\u0642\u0639\u06cc\u200c\u062a\u0631\u0634 \u0631\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f\u2026 \u0634\u062e\u0635\u06cc\u062a\u200c\u0647\u0627 \u0647\u0631 \u0631\u0648\u0632 \u0639\u062c\u06cc\u0628\u200c\u062a\u0631\u061b \u0622\u062f\u0645\u200c\u0647\u0627 \u0647\u0631 \u0644\u062d\u0638\u0647 \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647\u200c\u062a\u0631.\n\u062f\u06cc\u0648\u0627\u0646\u06af\u06cc\u061f \u06cc\u0627 \u0648\u0627\u0642\u0639\u06cc\u062a\u06cc \u06a9\u0647 \u062c\u0631\u0623\u062a \u062f\u06cc\u062f\u0646\u0634 \u0631\u0627 \u0646\u062f\u0627\u0631\u06cc\u0645\u061f \n\n\u0639\u0631\u0635\u0647\u200c \u0639\u0631\u0636\u0647\ud83d\ude42 \u0646\u0627\u062f\u0627\u0646\u06cc \u0648 \u062a\u0648\u0647\u0645 \u062f\u0627\u0646\u0627\u06cc\u06cc \u0627\u0633\u062a\n\u0647\u0631 \u0631\u0648\u0632 \u0627\u06cc\u0646 \u062f\u0627\u0633\u062a\u0627\u0646\u2026\u062f\u0627\u0631\u06a9 \u0648 \u0639\u0645\u06cc\u0642 \u200c\u062a\u0631\n\u0627\u0645\u0627 \u0647\u0645\u0627\u0647\u0646\u06af \u0628\u0627 \u062a\u0646\u067e\u0648\u0634 \u0645\u062f \u0631\u0648\u0632! \u062a\u0645 \u062a\u0645 \u0639\u0648\u0627\u0645!!!\n\u0639\u062c\u06cc\u0628\u200c\u0628\u0648\u062f\u0646 \u062a\u0631\u0633\u0646\u0627\u06a9 \u0646\u06cc\u0633\u062a\u061b\n\u062a\u0631\u0633\u0646\u0627\u06a9 \u0622\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0647\u0631\u06af\u0632 \u2026 !\n\n\u0648 \u0627\u06af\u0631 \u0634\u0645\u0633 \u062a\u0628\u0631\u06cc\u0632\u06cc \u0628\u0627\u062f\u0647\u200c\u0627\u06cc \u0628\u0631 \u062c\u0627\u0645\u0645 \u0646\u0647\u062f\u060c\n\u0645\u0633\u062a \u06a9\u0647 \u0634\u0648\u0645\u2026\n\u0628\u06cc\u200c\u067e\u0631\u0648\u0627\u060c \u0633\u062a\u0648\u0646 \u06a9\u06cc\u0648\u0627\u0646 \u0631\u0627 \u2026! \n\n\u0628\u06af\u0630\u0631\u06cc\u0645\u061b \n\n1.Operation Zero Disco: \nAttackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits, Cisco 9400, 9300, and legacy 3750G series devices are affected. A detailed analysis of the vulnerability (CVE-2017-3881) and PoC were published on our channel in 2018. Second exploited vulnerability (CVE-2025-20352) - Stack-based BoF. This vulnerability affects all versions of SNMP. Restrict SNMP access via ACLs and CoPP to management hosts only, switch to using only SNMPv3 with authPriv mode, stop using standard communities in v1/v2c, update IOS and IOS XE to builds with the fix, and configure monitoring of sysDescr sysUpTime and activity on port UDP/161. Disable telnet..\nCVE-2025-20352 SNMP Exposure Check (onesixtyone + parser).\n\n2.Framework BIOS Backdoor:\nThe mm command impleneted in Framework BIOS shells can be used to compromise a device pre-boot (BombShell). The attack surface \u201cbelow\u201d the operating system, encompassing firmware, bootloaders, and hardware components, presents a ripe target for threat actors. Implement proper configuration management and maintain up-to-date revocation lists. Follow the principle \"signed doesn't mean safe\"... .\n\n3 Fewer Weights, More Problems: \nA Practical Attack on LLM Pruning, Modern LLM pruning methods can be maliciously exploited... The most read post of the week on our channel.\n\n4. F5 BIG-IP Compromise:\nThere was no publication on this topic on our channel, since we have repeatedly drawn the attention of readers to the existing VERY serious problems with this equipment, publishing detailed PoC exploits on the channel in 2024 (CVE-2024-45844) and 2025 (CVE-2025-20029).\n\n\u2014 CISO as a Service \u2014\n| Strategic Cyber Defense & GRC\nResilient Through Knowledge\n2025.11.04\n\nhttps://www.linkedin.com/posts/alirezaghahrood_analytics-threatresearch-activity-7391560156158971904-XBpT", "creation_timestamp": "2026-09-01T17:00:13.075173Z"}, {"uuid": "670a15ed-ed3e-4a1b-9fd4-eedf559cb0aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-20029", "type": "seen", "source": "https://t.me/cissp/7834", "content": "#Analytics\n#ThreatResearch\nAn analytical review of the main cybersecurity events for the 2025\n\n\u0632\u0646\u062f\u06af\u06cc \u062f\u06cc\u0648\u0627\u0646\u0647\u200c\u0648\u0627\u0631!\n\u0647\u0627\u0644\u0648\u0648\u06cc\u0646 \u06a9\u0647 \u0646\u0632\u062f\u06cc\u06a9 \u0648 \u200c\u0631\u062f \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u062f\u0646\u06cc\u0627 \u0627\u0646\u06af\u0627\u0631 \u0686\u0647\u0631\u0647\u200c\u06cc \u0648\u0627\u0642\u0639\u06cc\u200c\u062a\u0631\u0634 \u0631\u0627 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f\u2026 \u0634\u062e\u0635\u06cc\u062a\u200c\u0647\u0627 \u0647\u0631 \u0631\u0648\u0632 \u0639\u062c\u06cc\u0628\u200c\u062a\u0631\u061b \u0622\u062f\u0645\u200c\u0647\u0627 \u0647\u0631 \u0644\u062d\u0638\u0647 \u0646\u0627\u0634\u0646\u0627\u062e\u062a\u0647\u200c\u062a\u0631.\n\u062f\u06cc\u0648\u0627\u0646\u06af\u06cc\u061f \u06cc\u0627 \u0648\u0627\u0642\u0639\u06cc\u062a\u06cc \u06a9\u0647 \u062c\u0631\u0623\u062a \u062f\u06cc\u062f\u0646\u0634 \u0631\u0627 \u0646\u062f\u0627\u0631\u06cc\u0645\u061f \n\n\u0639\u0631\u0635\u0647\u200c \u0639\u0631\u0636\u0647\ud83d\ude42 \u0646\u0627\u062f\u0627\u0646\u06cc \u0648 \u062a\u0648\u0647\u0645 \u062f\u0627\u0646\u0627\u06cc\u06cc \u0627\u0633\u062a\n\u0647\u0631 \u0631\u0648\u0632 \u0627\u06cc\u0646 \u062f\u0627\u0633\u062a\u0627\u0646\u2026\u062f\u0627\u0631\u06a9 \u0648 \u0639\u0645\u06cc\u0642 \u200c\u062a\u0631\n\u0627\u0645\u0627 \u0647\u0645\u0627\u0647\u0646\u06af \u0628\u0627 \u062a\u0646\u067e\u0648\u0634 \u0645\u062f \u0631\u0648\u0632! \u062a\u0645 \u062a\u0645 \u0639\u0648\u0627\u0645!!!\n\u0639\u062c\u06cc\u0628\u200c\u0628\u0648\u062f\u0646 \u062a\u0631\u0633\u0646\u0627\u06a9 \u0646\u06cc\u0633\u062a\u061b\n\u062a\u0631\u0633\u0646\u0627\u06a9 \u0622\u0646 \u0627\u0633\u062a \u06a9\u0647 \u0647\u0631\u06af\u0632 \u2026 !\n\n\u0648 \u0627\u06af\u0631 \u0634\u0645\u0633 \u062a\u0628\u0631\u06cc\u0632\u06cc \u0628\u0627\u062f\u0647\u200c\u0627\u06cc \u0628\u0631 \u062c\u0627\u0645\u0645 \u0646\u0647\u062f\u060c\n\u0645\u0633\u062a \u06a9\u0647 \u0634\u0648\u0645\u2026\n\u0628\u06cc\u200c\u067e\u0631\u0648\u0627\u060c \u0633\u062a\u0648\u0646 \u06a9\u06cc\u0648\u0627\u0646 \u0631\u0627 \u2026! \n\n\u0628\u06af\u0630\u0631\u06cc\u0645\u061b \n\n1.Operation Zero Disco: \nAttackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits, Cisco 9400, 9300, and legacy 3750G series devices are affected. A detailed analysis of the vulnerability (CVE-2017-3881) and PoC were published on our channel in 2018. Second exploited vulnerability (CVE-2025-20352) - Stack-based BoF. This vulnerability affects all versions of SNMP. Restrict SNMP access via ACLs and CoPP to management hosts only, switch to using only SNMPv3 with authPriv mode, stop using standard communities in v1/v2c, update IOS and IOS XE to builds with the fix, and configure monitoring of sysDescr sysUpTime and activity on port UDP/161. Disable telnet..\nCVE-2025-20352 SNMP Exposure Check (onesixtyone + parser).\n\n2.Framework BIOS Backdoor:\nThe mm command impleneted in Framework BIOS shells can be used to compromise a device pre-boot (BombShell). The attack surface \u201cbelow\u201d the operating system, encompassing firmware, bootloaders, and hardware components, presents a ripe target for threat actors. Implement proper configuration management and maintain up-to-date revocation lists. Follow the principle \"signed doesn't mean safe\"... .\n\n3 Fewer Weights, More Problems: \nA Practical Attack on LLM Pruning, Modern LLM pruning methods can be maliciously exploited... The most read post of the week on our channel.\n\n4. F5 BIG-IP Compromise:\nThere was no publication on this topic on our channel, since we have repeatedly drawn the attention of readers to the existing VERY serious problems with this equipment, publishing detailed PoC exploits on the channel in 2024 (CVE-2024-45844) and 2025 (CVE-2025-20029).\n\n\u2014 CISO as a Service \u2014\n| Strategic Cyber Defense & GRC\nResilient Through Knowledge\n2025.11.04\n\nhttps://www.linkedin.com/posts/alirezaghahrood_analytics-threatresearch-activity-7391560156158971904-XBpT", "creation_timestamp": "2026-09-02T01:03:47.644780Z"}]}