CVE-2025-54755
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-10-15
Last updated on: 2025-10-21
Assigner: F5 Networks
Description
Description
A directory traversal vulnerability exists in TMUI that allows an authenticated attacker to access files which are not limited to the intended files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| f5 | big-ip_advanced_firewall_manager | From 16.1.0 (inc) to 16.1.5.2.0.7.5 (inc) |
| f5 | big-ip_access_policy_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_advanced_web_application_firewall | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_analytics | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_application_acceleration_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_application_security_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_application_visibility_and_reporting | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_automation_toolchain | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_carrier-grade_nat | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_container_ingress_services | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_ddos_hybrid_defender | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_domain_name_system | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_edge_gateway | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_fraud_protection_service | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_global_traffic_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_link_controller | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_local_traffic_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_policy_enforcement_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_ssl_orchestrator | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_webaccelerator | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_websafe | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_access_policy_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_advanced_web_application_firewall | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_analytics | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_application_acceleration_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_application_security_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_application_visibility_and_reporting | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_automation_toolchain | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_carrier-grade_nat | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_container_ingress_services | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_ddos_hybrid_defender | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_domain_name_system | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_edge_gateway | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_fraud_protection_service | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_global_traffic_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_link_controller | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_local_traffic_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_policy_enforcement_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_ssl_orchestrator | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_webaccelerator | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_websafe | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_access_policy_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_access_policy_manager | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_advanced_firewall_manager | From 16.1.0 (inc) to 16.1.5.2.0.7.5 (inc) |
| f5 | big-ip_advanced_web_application_firewall | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_advanced_web_application_firewall | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_analytics | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_analytics | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_application_acceleration_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_application_acceleration_manager | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_application_security_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_application_security_manager | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_application_visibility_and_reporting | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_application_visibility_and_reporting | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_automation_toolchain | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_automation_toolchain | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_carrier-grade_nat | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_carrier-grade_nat | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_container_ingress_services | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_container_ingress_services | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_ddos_hybrid_defender | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_ddos_hybrid_defender | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_domain_name_system | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_domain_name_system | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_edge_gateway | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_edge_gateway | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_fraud_protection_service | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_fraud_protection_service | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_global_traffic_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_link_controller | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_link_controller | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_local_traffic_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_local_traffic_manager | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_policy_enforcement_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_policy_enforcement_manager | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_ssl_orchestrator | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_ssl_orchestrator | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_webaccelerator | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_webaccelerator | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_websafe | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_websafe | From 17.5.0 (inc) to 17.5.1 (inc) |
| f5 | big-ip_advanced_firewall_manager | From 16.1.0 (inc) to 16.1.5.2.0.7.5 (inc) |
| f5 | big-ip_advanced_firewall_manager | From 16.1.0 (inc) to 16.1.5.2.0.7.5 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-146 | The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a directory traversal issue in TMUI that allows an authenticated attacker to access files beyond the intended scope, potentially exposing sensitive information.
How can this vulnerability impact me? :
An attacker with authentication can exploit this vulnerability to access sensitive files that should be restricted, leading to potential data exposure and confidentiality breaches.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70