Is CVE-2020-5902 (F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution) being exploited in the wild?

What “being exploited in the wild” means for this CVE

For a CVE like this, “in the wild” is not a speculative label. It means defenders should assume real attackers are already targeting exposed F5 BIG-IP TMUI instances and that the issue has moved beyond proof-of-concept testing. The operational question is no longer whether the bug is interesting, but whether the affected appliance is reachable, internet-facing, and still trusted by internal teams.

That changes prioritisation immediately. A remotely reachable management interface with code execution risk is not just another patch item, it is a potential foothold into the control plane of a core network device. If the appliance is exposed, the blast radius can be broader than a typical server vulnerability because compromise can affect traffic handling, admin access, and adjacent management trust relationships.

If you need a broader pattern for this class of issue, Edge Device Security Guide is the right internal starting point because it covers exposed management interfaces, appliance credentials, logging minimums, and patching of internet-facing devices.

Why CISA KEV status should change your response

CISA KEV inclusion is a strong signal that exploitation is already credible enough to warrant emergency handling. In practice, that means asset owners should not wait for further confirmation from vendor blogs, social media, or their own detections before moving the issue into urgent remediation and exposure reduction.

For practitioners, KEV status is also a scoping tool. It tells you to find every instance of the product, verify whether the management interface is reachable from untrusted networks, and confirm whether the system is in a segment that would let an attacker pivot after initial access. The fact that a KEV-listed flaw is tied to ransomware activity makes the timing and exposure review more important, not less.

Use CISA Known Exploited Vulnerabilities Catalog to confirm the authoritative remediation posture, and pair that with the vendor advisory for product-specific handling. For general triage discipline, Zero-Day and Exploited Vulnerabilities Guide is a useful companion because it focuses on emergency mitigation, hotpatching, and post-patch hunting.

What to check before and after remediation

Before patching or mitigating, confirm whether the appliance has been externally exposed, whether there are historical signs of web-shell activity or unusual admin actions, and whether management access was ever shared with contractors or remote teams. For this class of flaw, compromise assessment matters because public exploitation often starts before defenders notice symptoms.

After remediation, validate that the device is not only updated but also monitored. Review logs for authentication anomalies, unexpected configuration changes, and unusual outbound connections from the appliance. If the system handled secrets, session material, or privileged administrative traffic, rotate anything that could have been observed or reused during exploitation.

For incident-quality follow-up on these devices, Vulnerability Management Guide is helpful because it ties exploited-vulnerability response to verification, exceptions, and remediation metrics. Where the issue sits on the edge of the network, Top 10 Network Security Misconfigurations adds useful context on exposed management interfaces and weak segmentation.

Risk and Threat Considerations

Internet-facing management interfaces are high-value targets because they collapse the distance between an external attacker and a trusted administration plane. Once code execution is available on that plane, the attacker may not need a second vulnerability to cause serious damage, especially if the device can influence traffic, credentials, or admin workflows.

Failure mechanism: Exploitation of the TMUI flaw can turn a web-facing appliance into an execution point for arbitrary commands, which can then be used to inspect configuration, tamper with traffic handling, or stage later access.

Impact: The likely consequences include device compromise, possible credential exposure, persistence on a privileged network appliance, and downstream access to internal systems or traffic paths that depend on it.

Practitioner Guidance

What to prioritise: Treat any exposed BIG-IP TMUI instance as an urgent asset until you have proven otherwise. Prioritise external exposure first, then evidence of compromise, then patching or mitigation, because an internet-reachable management plane is the highest-risk state.

What to verify: Confirm whether the appliance has been reachable from the public internet, whether logs show unusual admin sessions or configuration changes, and whether any secrets, certificates, or sessions stored or processed by the device may need rotation.

Practitioner takeaway: For exploited management-plane CVEs, the key decision is not whether the vulnerability is serious, but whether you can still trust the appliance enough to leave it in service without a compromise check.

Related resources from NHI Mgmt Group

• CVE-2020-5902 (F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution)
• Is CVE-2021-22991 (F5 BIG-IP Traffic Management Microkernel Buffer Overflow) being exploited in the wild?
• CVE-2021-22986 (F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution)
• Is CVE-2020-1350 (Microsoft Windows DNS Server Remote Code Execution) being exploited in the wild?