This vulnerability (CWE-22) in F5 BIG-IQ 8.4.0 involves improper limitation of a pathname to a restricted directory, enabling an authenticated low-privilege iControl REST user to create or modify arbitrary files through an undisclosed REST endpoint. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. The vulnerability is published and assigned by F5 but currently lacks an official remediation level or patch.

An attacker with low-privilege authenticated access to the iControl REST interface can modify or create arbitrary files on the BIG-IQ system, potentially leading to high integrity and availability impacts. Confidentiality is not impacted. This could allow disruption or manipulation of system operations or configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, monitor F5 advisories closely. Limit access to the iControl REST interface to trusted users only and consider additional access controls until a patch is available.