CVE-2020-5907: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, an authorized user provided with access only to the TMOS Shell (tmsh) may be able to conduct arbitrary file read/writes via the built-in sftp functionality (CVE, CERT-VN).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.2 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability is network accessible, requires high privileges, but no user interaction, and can affect confidentiality, integrity, and availability of the system (NVD).

The vulnerability allows an authenticated user with TMOS Shell access to perform unauthorized file read and write operations through the built-in sftp functionality, potentially compromising the confidentiality and integrity of sensitive system files (CERT-VN).

The vulnerability requires an attacker to have valid authentication credentials with access to the TMOS Shell (tmsh). While this limits the potential attack surface, authenticated users can exploit the vulnerability to perform unauthorized file operations (NVD).

F5 has released updated versions to address this vulnerability. Organizations should upgrade to the following versions based on their current deployment: 11.6.5.2, 12.1.5.2, 13.1.3.4, 14.1.2.6, or 15.1.0.4 (CERT-VN).