F5 · BIG-IP
The Traffic Management User Interface (TMUI), also called the Configuration utility, in F5 BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1 contains a remote code execution flaw in undisclosed pages. An attacker with network access can exploit it without authentication or user interaction to execute code on the affected device.
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
First seen exploited 21 days after disclosure. Public exploit code (Metasploit) was available 1 day before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
CVE-2020-5902 is a RCE vulnerability in the Traffic Management User Interface (TMUI) that allows for unauthenticated attackers, or authenticated users, with network access to the Configuration Utility (through the BIG-IP management port and/or self IPs) to execute arbitrary system commands, create or delete files, disable services, and execute arbitrary Java code.The Traffic Management User Interface (TMUI)
CVE-2020-5902—an RCE vulnerability in the BIG-IP Traffic Management User Interface (TMUI)—to take control of victim systems. On June 30, F5 disclosed CVE-2020-5902, stating that it allows attackers to, “execute arbitrary system commands, create or delete files, disable services, and/or execute arbitrary Java code.” - CISA Advisory
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2020-5902 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Following common trends, several actors shared information from multiple open source reports that discussed the vulnerability, an actor shared an alleged nmap exploit for CVE-2020-5902.
4 passages name itOriginal (opens in a new tab) ↗
CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781CISA Alert AA20-073A: Enterprise VPN SecurityCISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN PatchingCISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902CISA Security Tip: Securing Network Infrastructure Devices…
2 passages name itOriginal (opens in a new tab) ↗
Database CISA Alert AA20-133A: Top 10 Routinely Exploited Vulnerabilities CISA Alert AA20-206A: Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902 CISA Alert AA20-031A: Detecting Citrix CVE-2019-19781 CISA Alert AA20-107A: Continued Threat Actor Exploitation Post Pulse Secure VPN Patching…
3 passages name itOriginal (opens in a new tab) ↗
Many exploits can be mitigated by applying available patches for vulnerabilities (such as CVE-2019-11510, CVE-2019-19781, and CVE-2020-5902) affecting external remote services.
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.