F5 released a critical Remote Code Execution vulnerability (CVE-2020-5902) on June 30th, 2020 that affects several versions of BIG-IP. This RCE vulnerability allows attackers—or any user with remote access to the Traffic Management User Interface (TMUI)— to remotely execute system commands.
If your BIG-IP has its TMUI exposed to the Internet and is not running an updated version of the software, it may already be compromised, and you should follow your internal incident response procedures.
Because of the severity of this vulnerability, we recommend immediately installing the latest version in order to protect your BIG-IP.
If you cannot immediately update your BIG-IP, we advise you to:
Watch a panel of F5 security technologists answer your questions and deliver additional information about this vulnerability.