F5 BIG-IP (iHealth command / tmsh restricted shell): An authenticated attacker with at least a resource-administrator

Impact

An authenticated attacker with at least a resource-administrator role can use the iHealth command to break out of the restricted tmsh shell and get a full bash shell on the device — this specifically defeats BIG-IP's Appliance mode, the hardened mode operators use to lock admins out of the underlying OS on shared/regulated deployments.

Who can reach it

Requires an authenticated account with resource-administrator role (not full root/admin) — the attack is a privilege-escalation/shell-escape from a role that was supposed to be constrained.

What to do

Software upgrade to the fixed BIG-IP release per F5 K000154647. Part of the same October 2025 remediation batch as CVE-2025-53521 — apply in the same maintenance window. This specifically matters for shared/managed BIG-IP deployments that rely on Appliance mode to keep administrators out of shell access.

References