Maple Labs

CVE search · CVE-2026-41954

CVE-2026-41954

medium 6.9

Sensitive information disclosure vulnerability exists in the undisclosed iControl REST endpoint and TMOS Shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Open in the NVD CVE.org JSON

Details

Status
Analyzed
Published
Last changed
Source
f5sirt@f5.com
Weakness
CWE-200

Severity

VersionScoreVectorSource
CVSS 4.0 medium 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X f5sirt@f5.comSecondary
CVSS 3.1 medium 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N f5sirt@f5.comSecondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

  • f5 · big-ip_access_policy_manager
  • f5 · big-ip_advanced_firewall_manager
  • f5 · big-ip_advanced_web_application_firewall
  • f5 · big-ip_analytics
  • f5 · big-ip_application_acceleration_manager
  • f5 · big-ip_application_security_manager
  • f5 · big-ip_application_visibility_and_reporting
  • f5 · big-ip_automation_toolchain
  • f5 · big-ip_carrier-grade_nat
  • f5 · big-ip_container_ingress_services
  • f5 · big-ip_ddos_hybrid_defender
  • f5 · big-ip_domain_name_system
  • f5 · big-ip_edge_gateway
  • f5 · big-ip_fraud_protection_service
  • f5 · big-ip_global_traffic_manager
  • f5 · big-ip_link_controller
  • f5 · big-ip_local_traffic_manager
  • f5 · big-ip_policy_enforcement_manager
  • f5 · big-ip_ssl_orchestrator
  • f5 · big-ip_webaccelerator
  • f5 · big-ip_websafe
  • f5 · big-iq_centralized_management

References