CVE-2020-5902VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-5902: F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

Affects F5 BIG-IPSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
Ransomware: Used in ransomware campaigns
EPSS: 100.0% chance of exploitation in 30 days – higher than 100% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-5902 (opens in a new tab)

Description

CVE-2020-5902 is a remote code execution vulnerability in the F5 BIG-IP Traffic Management User Interface (TMUI). It affects undisclosed pages within the TMUI and has been exploited in the wild, including use in ransomware campaigns. The vulnerability is classified as high severity.

Summary

The F5 BIG-IP TMUI contains a remote code execution vulnerability identified as CVE-2020-5902. This flaw exists in undisclosed pages of the TMUI and allows attackers to execute arbitrary code remotely. The vulnerability has been actively exploited in the wild and has been associated with ransomware campaigns targeting affected systems.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected BIG-IP system, potentially leading to full system compromise. This can result in unauthorized access, data theft, disruption of services, and deployment of ransomware.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Due to the severity and active exploitation, it is recommended to monitor official F5 advisories for patches or mitigations and apply them promptly once available.

Weaknesses

CWE-22Path Traversal (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:26:41 UTC

Weaknesses

References

Related threats