Description
在BIG-IP版本15.0.0-15.1.0.3、14.1.0-14.1.2.5、13.1.0-13.1.3.3、12.1.0-12.1.5.1和11.6.1-11.6.5.1中，流量管理用户接口（TMUI），也称为配置实用程序，在未公开的页面中具有远程执行代码（RCE）漏洞。
F5 BIG-IP /tmui/login.jsp 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://my.f5.com/manage/s/article/K52145254
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/F5-BIG-IP/F5%20BIG-IP%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E(CVE-2023-46747).md
https://www.cnblogs.com/micr067/p/13269636.html
https://zhuanlan.zhihu.com/p/664376608
https://stack.chaitin.com/vuldb/detail/f6df0b7b-2e00-4161-96d7-5ecac9412357
https://s31k31.github.io/2020/07/06/CVE-2020-5902-F5-BigIP-TMUI/
https://medium.com/@m01e/cve-2020-5902-f5-big-ip-rce-%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90-1e50e24e0415
https://wiki.96.mk/Web%E5%AE%89%E5%85%A8/F5%20BIG-IP/%EF%BC%88CVE-2020-5902%EF%BC%89F5%20BIG-IP%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E/
https://pentest-tools.com/blog/big-ip-tmui-rce
https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-206a
https://projectdiscovery.io/blog/cve-2023-46747-5-big-ip-unauthenticated-rce-via-ajp-smuggling
https://zeropath.com/blog/f5-big-ip-cve-2023-46747-authentication-bypass-rce