Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.
Service Advisory

Due to a worldwide Microsoft Outlook disruption, emails to and from CSA may be delayed. We apologise for the inconvenience.

Cyber Security Agency of Singapore
Alerts

Critical Vulnerability in BIG-IP Application Delivery Controller (CVE-2020-5902)

4 July 2020

F5 has released security updates for the BIG-IP Application Delivery Controller, addressing a critical vulnerability (CVE-2020-5902) with a Common Vulnerability Scoring System (CVSS) score of 10 out of 10. An unauthenticated remote attacker could compromise the system by sending a specifically crafted Hypertext Transfer Protocol (HTTP) request to the server hosting the Traffic Management User Interface (TMUI) utility for BIG-IP configuration.

Successful exploitation of the vulnerability could allow an unauthenticated attacker to execute arbitrary code on the affected systems remotely.

The versions known to be vulnerable are:

  • 11.6.1 - 11.6.5

  • 12.1.0 - 12.1.5

  • 13.1.0 - 13.1.3

  • 14.1.0 - 14.1.2

  • 15.1.0 and 15.0.0

Administrators and users of the affected versions are advised to install the latest security updates immediately.

More information is available at:
https://support.f5.com/csp/article/K52145254 (opens in new tab)
https://nvd.nist.gov/vuln/detail/cve-2020-5902 (opens in new tab)