CVE-2019-6642: F5 BIG-IP Access Policy Manager

High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days.

In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.

Affected products

F5 BIG-IP Access Policy Manager: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Advanced Firewall Manager: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Analytics: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Application Acceleration Manager: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Application Security Manager: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Domain Name System: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Edge Gateway: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Fraud Protection Service: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Global Traffic Manager: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Link Controller: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Local Traffic Manager: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Policy Enforcement Manager: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IP Webaccelerator: from 11.5.2, up to and including 11.6.4; from 12.1.0, up to and including 12.1.4.2; from 13.0.0, up to and including 13.1.1.5; from 14.0.0, up to and including 14.1.0.5; version 15.0.0 only
F5 BIG-IQ Centralized Management: from 5.1.0, up to and including 5.4.0; from 6.0.0, up to and including 6.1.0
F5 Enterprise Manager: version 3.1.1 only
F5 Iworkflow: version 2.3.0 only

Published 2019-07-01. Last modified 2026-06-17.