CVE
CVE-2020-5902
- First Reported
- Aug 26, 2026
- Latest Reported
- Aug 26, 2026
CVE Enrichment
- CVSS
- 9.8 CRITICAL
- EPSS
- 100.00%
- EPSS Percentile
- 100.00%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- [email protected]
- Published
- 01-Jul-2020 22:15
- Last Modified
- 17-Jun-2026 10:22
- EPSS Date
- 2026-10-22
- CWE
- CWE-22
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:N /
S:U /
C:H /
I:H /
A:H
CISA KEV Details
- Date Added
- 2021-11-03
- Remediation Due
- 2022-05-03
- Known Ransomware Campaign Use
- Known
- Required Action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2020-5902
Affected Products / Versions
- f5 / big-ip_access_policy_manager
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* - f5 / big-ip_access_policy_manager
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* - f5 / big-ip_access_policy_manager
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* - f5 / big-ip_access_policy_manager
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* - f5 / big-ip_access_policy_manager
Version / affected range: * · from (inclusive) 15.0.0 · through (inclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* - f5 / big-ip_access_policy_manager
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_firewall_manager
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_firewall_manager
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_firewall_manager
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_firewall_manager
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_firewall_manager
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_firewall_manager
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_web_application_firewall
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_web_application_firewall
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_web_application_firewall
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_web_application_firewall
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_web_application_firewall
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* - f5 / big-ip_advanced_web_application_firewall
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* - f5 / big-ip_analytics
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* - f5 / big-ip_analytics
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* - f5 / big-ip_analytics
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* - f5 / big-ip_analytics
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* - f5 / big-ip_analytics
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* - f5 / big-ip_analytics
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* - f5 / big-ip_application_acceleration_manager
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_acceleration_manager
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_acceleration_manager
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_acceleration_manager
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_acceleration_manager
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_acceleration_manager
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_security_manager
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_security_manager
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_security_manager
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_security_manager
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_security_manager
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* - f5 / big-ip_application_security_manager
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* - f5 / big-ip_ddos_hybrid_defender
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* - f5 / big-ip_ddos_hybrid_defender
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* - f5 / big-ip_ddos_hybrid_defender
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* - f5 / big-ip_ddos_hybrid_defender
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* - f5 / big-ip_ddos_hybrid_defender
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* - f5 / big-ip_ddos_hybrid_defender
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:* - f5 / big-ip_domain_name_system
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* - f5 / big-ip_domain_name_system
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* - f5 / big-ip_domain_name_system
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* - f5 / big-ip_domain_name_system
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* - f5 / big-ip_domain_name_system
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* - f5 / big-ip_domain_name_system
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* - f5 / big-ip_fraud_protection_service
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* - f5 / big-ip_fraud_protection_service
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* - f5 / big-ip_fraud_protection_service
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* - f5 / big-ip_fraud_protection_service
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* - f5 / big-ip_fraud_protection_service
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* - f5 / big-ip_fraud_protection_service
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* - f5 / big-ip_global_traffic_manager
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_global_traffic_manager
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_global_traffic_manager
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_global_traffic_manager
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_global_traffic_manager
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_global_traffic_manager
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_link_controller
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* - f5 / big-ip_link_controller
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* - f5 / big-ip_link_controller
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* - f5 / big-ip_link_controller
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* - f5 / big-ip_link_controller
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* - f5 / big-ip_link_controller
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* - f5 / big-ip_local_traffic_manager
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_local_traffic_manager
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_local_traffic_manager
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_local_traffic_manager
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_local_traffic_manager
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_local_traffic_manager
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* - f5 / big-ip_policy_enforcement_manager
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* - f5 / big-ip_policy_enforcement_manager
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* - f5 / big-ip_policy_enforcement_manager
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* - f5 / big-ip_policy_enforcement_manager
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* - f5 / big-ip_policy_enforcement_manager
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* - f5 / big-ip_policy_enforcement_manager
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* - f5 / ssl_orchestrator
Version / affected range: * · from (inclusive) 11.6.1 · before (exclusive) 11.6.5.2
cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:* - f5 / ssl_orchestrator
Version / affected range: * · from (inclusive) 12.1.0 · before (exclusive) 12.1.5.2
cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:* - f5 / ssl_orchestrator
Version / affected range: * · from (inclusive) 13.1.0 · before (exclusive) 13.1.3.4
cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:* - f5 / ssl_orchestrator
Version / affected range: * · from (inclusive) 14.1.0 · before (exclusive) 14.1.2.6
cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:* - f5 / ssl_orchestrator
Version / affected range: * · from (inclusive) 15.0.0 · before (exclusive) 15.0.1.4
cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:* - f5 / ssl_orchestrator
Version / affected range: * · from (inclusive) 15.1.0 · before (exclusive) 15.1.0.4
cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- in Fortinet SSL-VPN, CVE-2019-19781 in Citrix ADC, CVE-2021-26855 in Microsoft Exchange Server, CVE-2020-5902 in F5 BIG-IP, CVE-2019-10068 in Kentico CMS, CVE-2021-44228 in Apache Log4j, CVE-2023-22515 in DOJ Disrupts QScan and QTRouter Platforms Attributed to China-Linked QTFY
CVE (12)
People (2)
Threat Actors (1)
MITRE ATT&CK (4)
Products (5)
Tools (1)
Industries (1)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.