This vulnerability in F5 BIG-IP's iControl REST API and TMOS Shell allows an authenticated user with Manager-level privileges to create configuration objects that can run arbitrary commands on the system. This is a least privilege violation (CWE-272) because the Manager role should not have the capability to execute arbitrary commands. The CVSS 3.1 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The impact includes high confidentiality, integrity, and availability consequences. The vulnerability affects several supported BIG-IP versions but lacks an official fix or vendor advisory at this time.

An attacker with Manager role privileges can escalate their capabilities to execute arbitrary commands on the affected BIG-IP system, potentially leading to full system compromise. This impacts confidentiality, integrity, and availability of the device and its managed network traffic. Because the attacker must already be authenticated with elevated privileges, the vulnerability primarily escalates existing access rather than enabling initial unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Manager role assignments to trusted personnel only and monitor for suspicious configuration changes. Avoid using affected versions if possible and apply vendor recommendations once available.