High · published October 15, 2025
⚡ An authenticated attacker can pull off a neat trick here—bypassing restrictions in the iHealth command and gaining access to a bash shell! 🔥 Think of it like a VIP pass at a concert. Normally, you can only access certain areas, but with this vulnerability, a resource administrator can waltz right past security into the backstage area, assuming full control instead of just watching from the crowd. If exploited, this vulnerability allows an attacker to cross a critical security boundary, potentially leading to unauthorized access and control over sensitive systems. This could lead to data breaches, service disruptions, and even complete system takeover—an absolutely devastating scenario for any organization.
Think of it like a VIP pass at a concert. Normally, you can only access certain areas, but with this vulnerability, a resource administrator can waltz right past security into the backstage area, assuming full control instead of just watching from the crowd. This vulnerability in the iHealth command enables an authenticated attacker with resource admin privileges to bypass tmsh restrictions, gaining access to a bash shell on BIG-IP systems operating in Appliance mode.
If exploited, this vulnerability allows an attacker to cross a critical security boundary, potentially leading to unauthorized access and control over sensitive systems. This could lead to data breaches, service disruptions, and even complete system takeover—an absolutely devastating scenario for any organization. To mitigate this risk, ensure that all systems are updated to the latest software version that addresses CVE-2025-61958. Additionally, review user roles and permissions to minimize exposure—restrict access only to those who absolutely need it. Consider disabling any unused functionalities related to the iHealth command. You've got this! With these steps, you can shore up your defenses and keep your systems secure. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| f5/big-ip_access_policy_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_advanced_firewall_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_advanced_web_application_firewall | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_analytics | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_acceleration_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_security_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_visibility_and_reporting | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_automation_toolchain | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_carrier-grade_nat | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_container_ingress_services | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_ddos_hybrid_defender | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_domain_name_system | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_edge_gateway | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_fraud_protection_service | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_global_traffic_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_link_controller | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_local_traffic_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_policy_enforcement_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_ssl_orchestrator | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_webaccelerator | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_websafe | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_access_policy_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_advanced_firewall_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_advanced_web_application_firewall | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_analytics | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_application_acceleration_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_application_security_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_application_visibility_and_reporting | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_automation_toolchain | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_carrier-grade_nat | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_container_ingress_services | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_ddos_hybrid_defender | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_domain_name_system | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_edge_gateway | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_fraud_protection_service | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_global_traffic_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_link_controller | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_local_traffic_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_policy_enforcement_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_ssl_orchestrator | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_webaccelerator | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_websafe | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_access_policy_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_advanced_firewall_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_advanced_web_application_firewall | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_analytics | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_application_acceleration_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_application_security_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_application_visibility_and_reporting | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_automation_toolchain | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_carrier-grade_nat | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_container_ingress_services | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_ddos_hybrid_defender | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_domain_name_system | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_edge_gateway | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_fraud_protection_service | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_global_traffic_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_link_controller | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_local_traffic_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_policy_enforcement_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_ssl_orchestrator | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_webaccelerator | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_websafe | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_access_policy_manager | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_advanced_firewall_manager | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_advanced_web_application_firewall | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_analytics | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_application_acceleration_manager | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_application_security_manager | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_application_visibility_and_reporting | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_automation_toolchain | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_carrier-grade_nat | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_container_ingress_services | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_ddos_hybrid_defender | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_domain_name_system | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_edge_gateway | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_fraud_protection_service | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_global_traffic_manager | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_link_controller | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_local_traffic_manager | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_policy_enforcement_manager | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_ssl_orchestrator | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_webaccelerator | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |
| f5/big-ip_websafe | ≥ 17.5.0, < 17.5.1.1 | 17.5.1.1 |