CVE-2025-20029 PoC — BIG-IP iControl REST and tmsh vulnerability

Source

https://github.com/mbadanoiu/CVE-2025-20029

Associated Vulnerability

Title:BIG-IP iControl REST and tmsh vulnerability (CVE-2025-20029)
Description:Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Description

CVE-2025-20029: Command Injection in TMSH CLI in F5 BIG-IP

Readme

# CVE-2025-20029: Command Injection in TMSH CLI in F5 BIG-IP

A command injection vulnerability exists in the F5 “tmsh” restricted CLI which allows an authenticated attacker to leverage the commands accessible by a low privilege user in order to bypass restrictions, inject arbitrary commands and obtain remote code execution as the “root” user on the target system.

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://my.f5.com/manage/s/article/K000148587).

### Requirements:

This vulnerability requires:
<br/>
- Valid user credentials
- The capability to send requests to the iControl REST component and/or the capability to execute tmsh commands

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2025-20029/blob/main/F5%20-%20CVE-2025-20029.pdf).

File Snapshot


 [4.0K]  /data/pocs/d4e36314d0e2924f0e9dd241f92ab71448593eb9
├── [316K]  F5 - CVE-2025-20029.pdf
└── [ 892]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!