This vulnerability in F5 BIG-IP products involves improper neutralization of special elements in OS commands (CWE-78), enabling an authenticated user with elevated roles to escalate privileges by creating SNMP configuration objects through the iControl SOAP interface. The affected versions include 16.1.0, 17.1.0, 17.5.0, and 21.0.0. The CVSS v3.1 base score is 8.7, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impact on confidentiality and integrity with no impact on availability. The vendor has not published a patch or official remediation at this time, and the software versions that have reached End of Technical Support are excluded from evaluation.

Successful exploitation allows an authenticated attacker with Resource Administrator or Administrator privileges to escalate their privileges by manipulating SNMP configuration objects via iControl SOAP. This can lead to compromise of confidentiality and integrity of the affected system. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the iControl SOAP interface to trusted administrators only and monitor for suspicious activity related to SNMP configuration changes. Avoid using affected versions if possible or apply vendor recommended mitigations once published.