{"id":"CVE-2026-41954","state":"PUBLISHED","title":"iControl REST and tmsh vulnerability","description":"Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","publishedAt":"2026-05-13T14:12:27.618Z","updatedAt":"2026-05-13T16:17:41.943Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"f5"},"assigner":"f5","products":["F5 BIG-IP","F5 BIG-IQ"],"affected":[{"vendor":"F5","product":"BIG-IP","defaultStatus":"unknown","versions":[{"version":"21.1.0","status":"unaffected","lessThan":"*","versionType":"custom"},{"version":"21.0.0","status":"affected","lessThan":"21.0.0.1","versionType":"custom"},{"version":"17.5.0","status":"affected","lessThan":"17.5.1.4","versionType":"custom"},{"version":"17.1.0","status":"affected","lessThan":"17.1.3.1","versionType":"custom"},{"version":"16.1.0","status":"affected","lessThan":"*","versionType":"custom"}],"modules":["All Modules"]},{"vendor":"F5","product":"BIG-IQ","defaultStatus":"unknown","versions":[{"version":"8.4.0","status":"affected","lessThan":"8.4.1","versionType":"custom"}]}],"references":["https://my.f5.com/manage/s/article/K32950402"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/41xxx/CVE-2026-41954.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-41954","state":"PUBLISHED","datePublished":"2026-05-13T14:12:27.618Z","dateUpdated":"2026-05-13T16:17:41.943Z","assignerShortName":"f5","assignerOrgId":"9dacffd4-cb11-413f-8451-fbbfd4ddc0ab","dateReserved":"2026-04-30T23:02:33.898Z"},"containers":{"cna":{"title":"iControl REST and tmsh vulnerability","descriptions":[{"lang":"en","value":"Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}],"affected":[{"vendor":"F5","product":"BIG-IP","defaultStatus":"unknown","versions":[{"version":"21.1.0","status":"unaffected","lessThan":"*","versionType":"custom"},{"version":"21.0.0","status":"affected","lessThan":"21.0.0.1","versionType":"custom"},{"version":"17.5.0","status":"affected","lessThan":"17.5.1.4","versionType":"custom"},{"version":"17.1.0","status":"affected","lessThan":"17.1.3.1","versionType":"custom"},{"version":"16.1.0","status":"affected","lessThan":"*","versionType":"custom"}],"modules":["All Modules"]},{"vendor":"F5","product":"BIG-IQ","defaultStatus":"unknown","versions":[{"version":"8.4.0","status":"affected","lessThan":"8.4.1","versionType":"custom"}]}],"references":[{"url":"https://my.f5.com/manage/s/article/K32950402","tags":["vendor-advisory","patch"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"f5","orgId":"9dacffd4-cb11-413f-8451-fbbfd4ddc0ab","dateUpdated":"2026-05-13T14:12:27.618Z"},"credits":[{"lang":"en","type":"finder","value":"F5"}],"datePublic":"2026-05-13T14:00:00.000Z","source":{"discovery":"INTERNAL"},"x_generator":{"engine":"F5 SIRTBot v1.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-13T16:01:01.204932Z","id":"CVE-2026-41954","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-13T16:17:41.943Z"}}]}}}