{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3af5big-ip_advanced_web_application_firewall/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*","cpe:2.3:a:f5:ssl_orchestrator:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2020-5902"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-SV3NBEAST-CVE-2020-5902_RCE\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["BIG-IP","BIG-IQ","Traffix SDC"],"_cs_severities":["critical"],"_cs_tags":["CVE-2020-5902","F5","TMUI","RCE","exploit","web"],"_cs_type":"advisory","_cs_vendors":["F5"],"content_html":"\u003cp\u003eThis brief focuses on detecting exploitation attempts of CVE-2020-5902, a remote code execution (RCE) vulnerability in the Traffic Management User Interface (TMUI) of F5 BIG-IP, BIG-IQ, and Traffix SDC devices. The vulnerability allows unauthenticated attackers to execute arbitrary commands on the affected devices. Detection relies on identifying specific patterns in syslog data indicative of exploit attempts, including \u0026quot;hsqldb;\u0026quot; and directory traversal sequences (\u0026quot;..;\u0026quot;). Successful exploitation can lead to full system compromise, unauthorized access, data exfiltration, and lateral movement within the network. The exploitation activity is significant because these F5 devices are often critical network infrastructure components.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker sends a malicious HTTP request to the TMUI interface of an F5 BIG-IP, BIG-IQ, or Traffix SDC device.\u003c/li\u003e\n\u003cli\u003eThe request contains a crafted URL with directory traversal sequences (\u0026quot;..;\u0026quot;) designed to bypass authentication and access restricted resources.\u003c/li\u003e\n\u003cli\u003eThe request includes the \u0026quot;hsqldb;\u0026quot; string, used to exploit a Java deserialization vulnerability within the TMUI.\u003c/li\u003e\n\u003cli\u003eThe vulnerable component processes the malicious request without proper sanitization or validation.\u003c/li\u003e\n\u003cli\u003eThe directory traversal allows the attacker to access and modify sensitive files or execute commands within the context of the TMUI application.\u003c/li\u003e\n\u003cli\u003eThe \u0026quot;hsqldb;\u0026quot; payload triggers the execution of arbitrary Java code, allowing the attacker to gain full control of the system.\u003c/li\u003e\n\u003cli\u003eThe attacker installs a backdoor or establishes a reverse shell to maintain persistent access.\u003c/li\u003e\n\u003cli\u003eThe attacker performs reconnaissance, steals sensitive data, or uses the compromised system as a pivot point for further attacks within the network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2020-5902 allows attackers to execute arbitrary commands on affected F5 devices. This can result in complete system compromise, leading to unauthorized access to sensitive data, data exfiltration, or further lateral movement within the network. Given that F5 devices are often critical network infrastructure components, a successful attack can have a significant impact on the confidentiality, integrity, and availability of network services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect F5 TMUI RCE CVE-2020-5902 Exploitation Attempts via Syslog\u0026quot; to detect exploit attempts based on syslog data.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect F5 TMUI RCE CVE-2020-5902 Exploitation Attempts via Web Logs\u0026quot; to detect exploit attempts based on web server logs.\u003c/li\u003e\n\u003cli\u003eIngest logs via syslog from F5 BIG-IP, BIG-IQ, and Traffix SDC devices to ensure coverage, as recommended in the \u0026quot;How to Implement\u0026quot; section.\u003c/li\u003e\n\u003cli\u003eInvestigate and remediate any detected exploitation attempts immediately.\u003c/li\u003e\n\u003cli\u003eRefer to F5's advisory (\u003ca href=\"https://support.f5.com/csp/article/K52145254\"\u003ehttps://support.f5.com/csp/article/K52145254\u003c/a\u003e) for patching and mitigation guidance.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T18:47:43Z","date_published":"2026-05-28T17:50:22Z","id":"https://feed.craftedsignal.io/briefs/2026-05-f5-tmui-rce/","summary":"Exploitation attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices via CVE-2020-5902 are detected through regex pattern matching of exploit strings and directory traversal sequences in syslog data, potentially leading to remote code execution and system compromise.","title":"F5 TMUI Remote Code Execution Vulnerability (CVE-2020-5902) Exploitation Attempts","url":"https://feed.craftedsignal.io/briefs/2026-05-f5-tmui-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:f5:big-Ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}