This vulnerability in F5 BIG-IP's iControl REST and TMOS Shell allows an attacker with Manager-level privileges to escalate their capabilities by creating configuration objects that permit arbitrary command execution. This represents a least privilege violation (CWE-272). The CVSS 3.1 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The issue affects multiple recent versions of BIG-IP but excludes versions that have reached End of Technical Support. No vendor advisory or patch information is currently available.

An attacker with Manager role privileges can execute arbitrary commands on the affected BIG-IP system, potentially leading to complete system compromise, including confidentiality, integrity, and availability impacts. This elevates the risk from a privileged user to full control of the device. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Manager role assignments to trusted personnel only and monitor for unusual configuration changes. Avoid using versions listed as affected if possible, or consider upgrading to versions not listed once vendor guidance is available.