CVE-2019-6642

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-01 · updated 2026-06-17

Description

In BIG-IP 15.0.0, 14.0.0-14.1.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.2, and 11.5.2-11.6.4, BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0, iWorkflow 2.3.0, and Enterprise Manager 3.1.1, authenticated users with the ability to upload files (via scp, for example) can escalate their privileges to allow root shell access from within the TMOS Shell (tmsh) interface. The tmsh interface allows users to execute a secondary program via tools like sftp or scp.

Affected products

F5 BIG-IP APM: from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
BIG-IP: from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 Big-Ip Analytics: from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 Networks, Inc. BIG-IP (AAM): from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
BIG-IP ASM: from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 BIG-IP DNS: from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 Big-Ip Edge Gateway: from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 Big-Ip Fraud Protection Service: from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 Big-Ip Global Traffic Manager: from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 Big-Ip Link Controller: from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 BIG-IP (LTM): from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 Networks, Inc. BIG-IP (PEM): from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 Big-Ip Webaccelerator: from 11.5.2 through 11.6.4; from 12.1.0 through 12.1.4.2; from 13.0.0 through 13.1.1.5; from 14.0.0 through 14.1.0.5; 15.0.0
F5 BIG-IQ: from 5.1.0 through 5.4.0; from 6.0.0 through 6.1.0
F5 Networks, Inc. Enterprise Manager: 3.1.1
F5 Networks, Inc. iWorkflow: 2.3.0

References

Get alerted when CVE-2019-6642 or the next vulnerability affects your stack