F5 BIG-IP (iControl REST): An unauthenticated attacker can send undisclosed requests to the iControl REST management

Impact

An unauthenticated attacker can send undisclosed requests to the iControl REST management API and bypass authentication entirely, then run arbitrary system commands, create/delete files, or disable services — full compromise of the load balancer. This is one of the most widely exploited F5 bugs on record and is confirmed in CISA's KEV catalog; mass scanning for it started within days of disclosure.

Who can reach it

Remote and unauthenticated, but only if the iControl REST management interface is reachable from the attacker's network position — the standard defense-in-depth advice from F5 is that this interface should never be internet-facing, only reachable from a management network.

What to do

Software upgrade to the fixed BIG-IP version per F5 K23605346, then reboot; if immediate patching isn't possible, restricting iControl REST access to a trusted management network (or disabling it on the self-IP/external interfaces) is the documented interim mitigation. Given confirmed mass exploitation, treat any unpatched device with an internet-reachable management plane as likely already compromised, not just vulnerable.

References