CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.

First PoC 2020-07-05
1992 days →Metasploit 2025-12-17
304 days →First cited attacker 2026-10-17

Exploited in the wild: Yesadded 2021-11-03 · due 2022-05-03 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast: 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure: not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

5 known · links only

Metasploit1

F5 BIG-IP TMUI Directory Traversal and File Upload RCE ↗
This module exploits a directory traversal in F5's BIG-IP Traffic Management User Interface (TMUI) to upload a shell script and execute it as the Unix root user. Unix shell access is obtained by escaping the restricted Traffic Management Shell (TMSH). The escape may not be reliable, and you may have to run the exploit multiple times. Sorry! Versions 11.6.1-11.6.5, 12.1.0-12.1.5, 13.1.0-13.1.3, 14.1.0-14.1.2, 15.0.0, and 15.1
ruby · seen 2026-10-18

Exploit-DB3

Nuclei1

F5 BIG-IP TMUI - Remote Code Execution ↗
F5 BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
yaml · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Cited as exploited by

Fox Kitten
1. “Fox Kitten also upgraded its attack arsenal to include an exploit for CVE-2020-5902 , a vulnerability disclosed in early July that impacts BIG-IP”
  cited as exploiting · source: zdnet.com ↗ · 2026-10-17
2. “F5 Networks BIG-IP load balancers (CVE-2020-5902)”
  cited as exploiting · named nearby · source: zdnet.com ↗ · 2026-10-17
3. “The adversary is particularly interested in exploits related to VPNs and network appliances , including CVE-2019-11510, CVE-2019-19781, and most recently CVE-2020-5902; reliance on exploits such as these lends to an opportunistic operational model.”
  cited as exploiting · named nearby · source: crowdstrike.com ↗ · 2026-10-17
BackdoorDiplomacy
1. “BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor.”
  cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
2. “In one specific instance, we observed the operators exploit an F5 BIP-IP vulnerability ( CVE-2020-5902 ) to drop a Linux backdoor.”
  cited as exploiting · named nearby · source: welivesecurity.com ↗ · 2026-10-17
3. “In their investigation ESET discovered a Quarian Linux variant sample sharing a C2 server with Windows variants, which was reportedly deployed by exploiting a known RCE vulnerability (CVE-2020-5902) in F5 Networks’ BIG-IP traffic management user interface or configuration utility.”
  cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

Each actor is cited by the quoted source, linked under the quote. A citation is that source's claim, not our confirmation.

References

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Signals