The vulnerability arises from improper limitation of a pathname to a restricted directory (CWE-22) in the NGINX Agent's config_dirs directive. A low-privileged attacker, once authenticated remotely, can exploit this to read and write files outside the designated secure directories. This can lead to unauthorized access and modification of files beyond the intended scope, potentially compromising system integrity. The affected version is exactly 2.0.0. There is no vendor-provided patch or official remediation level indicated in the advisory. No known exploits are reported in the wild.

A remotely authenticated attacker with low privileges can bypass directory restrictions to gain limited read and write access outside the configured secure directories. This may allow unauthorized access to sensitive files and modification of files outside the intended scope, potentially leading to partial compromise of system integrity. Confidentiality and integrity impacts are limited; availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor F5 advisories for updates. Until a fix is available, restrict access to the NGINX Agent and its configuration interfaces to trusted users only to reduce risk.