This vulnerability in F5 BIG-IP's iControl REST API permits an authenticated user with Manager-level privileges to create configuration objects that can run arbitrary commands on the system. The flaw arises from improper handling of privileged API functions, classified under CWE-648. Affected versions include 21.0.0, 17.5.0, 17.1.0, and 16.1.0. The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level is currently documented, and the product is not a cloud service.

Successful exploitation allows a highly privileged attacker to execute arbitrary commands on the BIG-IP system, potentially compromising confidentiality, integrity, and availability of the device and its managed network traffic. This could lead to full system compromise or disruption of services managed by the BIG-IP appliance. Since the attacker must already have Manager-level authenticated access, the vulnerability primarily escalates the impact of an insider or compromised privileged account.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Manager-level access to trusted administrators only and monitor for unusual configuration changes. Follow F5's security advisories closely for updates on patches or mitigations. No vendor advisory or official fix information is currently available.