{"id":"CVE-2020-5902","kind":"vulnerability","aliases":["CVE-2020-5902"],"related":[],"title":"F5 BIG-IP: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability","description":"In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.","summary":"F5 BIG-IP's Traffic Management User Interface (TMUI) has a remote code execution flaw in undisclosed pages. An unauthenticated attacker on the network can run code on the appliance, and CISA reports it is being exploited in the wild, including in ransomware campaigns.","severity":"critical","cvss":10.0,"epss":0.99999,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"F5 BIG-IP","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","f5-big-ip","infrastructure","load-balancer","ransomware","self-hosted"],"not_affected_if":["no-big-ip","tmui-disabled"],"how_to_check":null,"fix":"Apply the F5 vendor updates for BIG-IP per the vendor advisory referenced by CISA (the sources do not list the fixed versions).","status":"open","published_at":"2020-07-01T15:15:15+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:33:37+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T21:33:37Z","model":"claude-haiku-5-5","output":{"fix":"Apply the F5 vendor updates for BIG-IP per the vendor advisory referenced by CISA (the sources do not list the fixed versions).\nUnknown which exact versions are affected in the sources provided.","reach":"network","impact":"high","summary":"F5 BIG-IP's Traffic Management User Interface (TMUI) has a remote code execution flaw in undisclosed pages. An unauthenticated attacker on the network can run code on the appliance, and CISA reports it is being exploited in the wild, including in ransomware campaigns.","category":"infrastructure","who_cares":["f5-big-ip","load-balancer","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs code on the BIG-IP appliance and can take it over.","analyst_note":"Find the F5 advisory for CVE-2020-5902 to get affected and fixed versions, the TMUI check and any IOC or mitigation steps (for example restricting TMUI access).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["tmui-disabled","no-big-ip"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000499,"input_tokens":2849,"output_tokens":429,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the F5 advisory for CVE-2020-5902 to get affected and fixed versions, the TMUI check and any IOC or mitigation steps (for example restricting TMUI access).","search":"'-2020':19A,22A '-5902':20A,23A '11.6.1':100C '11.6.5.1':101C '12.1.0':97C '12.1.5.1':98C '13.1.0':95C '13.1.3.3':96C '14.1.0':93C '14.1.2.5':94C '15.0.0':91C '15.1.0.3':92C 'also':108C 'applianc':71B 'attack':62B 'balanc':36B 'big':3A,7A,26A,31B,43B,88C 'big-ip':2A,6A,25A,42B,87C 'campaign':85B 'cisa':73B 'code':15A,54B,68B,118C 'configur':113C 'cve':18A,21A 'execut':16A,55B,119C 'exploit':28B,78B 'f5':1A,5A,24A,30B,41B 'f5-big-ip':29B 'flaw':56B 'host':40B 'includ':82B 'infrastructur':33B 'interfac':12A,49B,106C 'ip':4A,8A,27A,32B,44B,89C 'load':35B 'load-balanc':34B 'manag':10A,47B,104C 'network':65B 'page':59B,124C 'ransomwar':37B,84B 'rce':120C 'refer':109C 'remot':14A,53B,117C 'report':74B 'run':67B 'self':39B 'self-host':38B 'tmui':13A,50B,107C 'traffic':9A,46B,103C 'unauthent':61B 'undisclos':58B,123C 'user':11A,48B,105C 'util':114C 'version':90C 'vulner':17A,121C 'wild':81B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-07-01T15:15:15+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-5902","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-5902","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T11:39:18+00:00","note":null},{"source":"epss","external_id":"CVE-2020-5902","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5902","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-5902","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5902","severity":null,"published_at":"2020-07-01T15:15:15+00:00","modified_at":"2026-06-17T03:22:25+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}