CVE-2020-5881: F5 BIG-IP Access Policy Manager

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition (VE) is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer (NDAL) Interfaces can lock up and in turn disrupting the communication between the mcpd and tmm processes.

Affected products

  • F5 BIG-IP Access Policy Manager: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1
  • F5 BIG-IP Advanced Firewall Manager: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1
  • F5 BIG-IP Analytics: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1
  • F5 BIG-IP Application Acceleration Manager: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1
  • F5 BIG-IP Application Security Manager: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1
  • F5 BIG-IP Domain Name System: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1
  • F5 BIG-IP Fraud Protection Service: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1
  • F5 BIG-IP Global Traffic Manager: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1
  • F5 BIG-IP Link Controller: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1
  • F5 BIG-IP Local Traffic Manager: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1
  • F5 BIG-IP Policy Enforcement Manager: from 13.1.0, up to and including 13.1.3.3; from 14.1.0, up to and including 14.1.2.3; from 15.0.0, up to and including 15.1.0.1

Published 2020-04-30. Last modified 2026-06-17.