F5 BIG-IP prior 17.1.3.1/17.5.1.4 iControl REST ssh-password cleartext storage

Summaryinfo

A vulnerability identified as problematic has been detected in F5 BIG-IP. This impacts an unknown function of the component iControl REST. Performing a manipulation of the argument ssh-password results in cleartext storage. This vulnerability was named CVE-2026-28758. The attack needs to be approached locally. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in F5 BIG-IP. This affects some unknown functionality of the component iControl REST. The manipulation of the argument ssh-password with an unknown input leads to a cleartext storage vulnerability. CWE is classifying the issue as CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. This is going to have an impact on confidentiality. The summary by CVE is:

When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

It is possible to read the advisory at my.f5.com. This vulnerability is uniquely identified as CVE-2026-28758 since 05/01/2026. The exploitability is told to be easy. Attacking locally is a requirement. Additional levels of successful authentication are necessary for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1555 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 316085 (F5 Networks BIG-IP : iControl REST vulnerability (K000158070)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 17.1.3.1 or 17.5.1.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (316085) and CERT Bund (WID-SEC-2026-1532). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• F5 BIG-IP

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion