Vulnerability · Published Jul 1, 2020 · Assigned by f5

CVE-2020-5906

High 8.1

In plain English

A high-severity security flaw in BIG-IP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS NVD)8.1High

Exploit odds (30 days)1.2%top 32.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In versions 13.1.0-13.1.3.3, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, the BIG-IP system does not properly enforce the access controls for the scp.blacklist files. This allows Admin and Resource Admin users with Secure Copy (SCP) protocol access to read and overwrite blacklisted files via SCP.

Affected products (as reported)

Vendor	Product	Versions
n/a	BIG-IP	13.1.0-13.1.3.3, 12.1.0-12.1.5.2, 11.6.1-11.6.5.2

References

https://support.f5.com/csp/article/K82518062 x_refsource_MISC
VU#290915 third-party-advisory, x_refsource_CERT-VN