F5 BIG-IP and BIG-IQ TMUI flaw enables administrative account creation

BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI).

Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP management interface to escalate privileges by creating administrative accounts on the BIG-IP system. There is no data plane exposure; this is a control plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• F5 BIG-IP: versions on the 21.1.0 branch with < 21.1.0.1, the 21.0.0 branch with < 21.0.0.3, the 17.5.0 branch with < 17.5.1.8, and the 17.1.0 branch with < 17.1.3.4 are marked affected. The default status outside the listed conditions is unknown.
• F5 BIG-IQ: the 8.4.0 branch with < 8.4.2.1 is marked affected in the TMOS module. The supplied record gives this product a default status of unaffected.
• Software versions that have reached End of Technical Support (EoTS) were not evaluated. The status of parallel or later branches must not be inferred when they are not explicitly covered by the record.

F5 BIG-IP and F5 BIG-IQ are listed as affected by a management-plane flaw classified as CWE-918 Server-Side Request Forgery (SSRF). The vulnerable request, attacker-controlled parameter, and specific internal request flow are not disclosed.

1. An authenticated user of any role reaches TMUI over the network through the management interface.
2. The user sends an undisclosed request to TMUI. The supplied attack characteristics indicate that no user interaction is required, low privileges are sufficient, and attack complexity is low.
3. The vulnerable behavior may create an administrative user account, resulting in privilege escalation.

The stated scope is the control plane only. The record does not identify direct data-plane exposure. The implementation details needed to reproduce the issue or determine any precise configuration dependency remain unknown.

The issue is network reachable but requires an authenticated attacker with network access to the BIG-IP management interface. An account of any role may be sufficient to reach the vulnerable behavior; no user interaction is required and the supplied attack characteristics indicate low complexity.

The supplied record does not identify a public exploit and does not provide a known-exploited status. The CISA ADP data returned during research records exploitation: none and automatable: no; this does not prove that undisclosed or future exploitation cannot occur.

Successful exploitation may turn a low-privilege authenticated account into an administrative account by creating additional administrative users on the affected system. The technical impact is primarily within the control plane and may allow changes to management functions that affect confidentiality, integrity, or availability.

The issue requires authentication and network access to the management interface, so it is not an unauthenticated data-plane attack path. The source description does not provide enough detail to determine the exact request, accessed data, or whether a special configuration is required. No data-plane exposure is stated in the record.

Successful exploitation may allow an attacker to create unauthorized administrative accounts and obtain control-plane access on an affected deployment.

• The resulting privilege escalation may permit configuration, policy, or other management changes that the original account was not authorized to make.
• Unauthorized administrative access could affect the confidentiality, integrity, and availability of management functions.
• The record does not describe data-plane exposure, so this issue should not be treated as a direct path into data traffic.

1. Upgrade F5 BIG-IP within the affected branch to the supplied remediation boundary: 21.1.0.1 for the 21.1.0 branch, 21.0.0.3 for the 21.0.0 branch, 17.5.1.8 for the 17.5.0 branch, or 17.1.3.4 for the 17.1.0 branch.
2. Upgrade F5 BIG-IQ on the affected 8.4.0 branch to 8.4.2.1.
3. If an upgrade cannot be completed immediately, restrict network access to the management interface and TMUI to authorized management networks. This is a precaution based on the stated access requirement, not a vendor-confirmed workaround.
4. After updating, recheck version inventory, review existing administrative accounts, and investigate unexpected account or privilege changes. The record does not provide an official workaround or recovery guidance for EoTS versions.

1. Inventory F5 BIG-IP and BIG-IQ deployments, identify each product branch, and compare it with the version boundaries in affected_summary.
2. Determine which deployments allow non-administrative users to reach the management interface and TMUI over the network. This is an exposure check, not proof that exploitation occurred.
3. Review administrative-account inventory on the control plane for newly created accounts or privilege changes without an approved explanation.
4. Review available management audit records and telemetry for unexpected account creation or privilege-change activity.
5. Absence of suspicious events does not prove that a system is safe. The record does not provide a named log event, endpoint, or specific IOC for the undisclosed request.