The vulnerability in F5 BIG-IP DNS involves the gtm_add and bigip_add iControl REST commands returning the ssh-password parameter in cleartext within the REST response and audit logs. This cleartext storage of sensitive information (CWE-312) can be accessed by a highly privileged, authenticated attacker who has audit log access. Affected versions include 16.1.0, 17.1.0, and 17.5.0. The CVSS 3.1 base score is 4.4, reflecting a medium severity with local attack vector, low attack complexity, and high privileges required. No official patch or remediation level has been published by F5 as of the data provided.

The impact is limited to confidentiality as the ssh-password is exposed in cleartext to highly privileged users with audit log access. There is no impact on integrity or availability. The vulnerability requires local access with high privileges and does not involve user interaction. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict audit log access strictly to trusted administrators and monitor for unauthorized access. Avoid using affected versions if possible or consider compensating controls to protect audit logs containing sensitive information.