CVE-2018-5516: F5 BIG-IP Access Policy Manager

Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days.

On F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.2, or 11.2.1-11.6.3.1, Enterprise Manager 3.1.1, BIG-IQ Centralized Management 5.0.0-5.4.0 or 4.6.0, BIG-IQ Cloud and Orchestration 1.0.0, or F5 iWorkflow 2.0.2-2.3.0, authenticated users granted TMOS Shell (tmsh) access can access objects on the file system which would normally be disallowed by tmsh restrictions. This allows for authenticated, low privileged attackers to exfiltrate objects on the file system which should not be allowed.

Affected products

  • F5 BIG-IP Access Policy Manager: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Advanced Firewall Manager: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Analytics: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Application Acceleration Manager: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Application Security Manager: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Domain Name System: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Edge Gateway: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Enterprise Manager: version 3.1.1 only
  • F5 BIG-IP Global Traffic Manager: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Link Controller: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Local Traffic Manager: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Policy Enforcement Manager: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Webaccelerator: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IP Websafe: from 11.2.1, up to and including 11.6.3; from 12.1.0, up to and including 12.1.2; from 13.0.0, up to and including 13.1.0
  • F5 BIG-IQ Centralized Management: from 5.0.0, up to and including 5.4.0; version 4.6.0 only
  • F5 BIG-IQ Cloud And Orchestration: version 1.0.0 only
  • F5 f5 Iworkflow: from 2.0.2, up to and including 2.3.0

Published 2018-05-02. Last modified 2026-06-17.