F5 BIG-IP TMUI CVE-2020-5902 (unauthenticated remote code execution in the Configuration utility, CISA KEV, AA20-206A): which versions are affected and how do I check an old BIG-IP for compromise?

What it is: CVE-2020-5902 is a critical remote code execution flaw in the Traffic Management User Interface (TMUI, the BIG-IP Configuration utility web interface). Anyone who can reach TMUI, without logging in, could run commands, create or delete files and take over the device. F5 patched it on June 30, 2020; exploitation started within days, CISA published advisory AA20-206A, and F5 said unpatched exposed devices were likely already compromised. It's in CISA's KEV catalog. Am I affected: - BIG-IP 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1 and 11.6.1-11.6.5.1 (per NVD), with TMUI reachable through the management port or self IPs. - Check the version with tmsh show sys version, and whether self IPs allow TMUI (Port Lockdown settings). Fix: 1. Upgrade to a fixed release listed in F5 advisory K52145254 (the first fixed builds on each branch follow the ranges above, e.g. 15.1.0.4, 14.1.2.6, 13.1.3.4, 12.1.5.2, 11.6.5.2); today, move to a currently supported BIG-IP version, which also covers CVE-2022-1388 and later bugs. 2. Restrict TMUI: make the management interface reachable only from a dedicated management network, and block TMUI on self IPs (Port Lockdown 'Allow None' or a restricted list). 3. Hunt for compromise, as CISA and F5 advise: check with F5's IoC detection tool and the indicators in K52145254; review processes, unusual authentications and outbound connections from the device; CISA's Snort signature flags path traversal requests against /tmui/login.jsp in logs. 4. If you find signs of compromise: take the device offline, reimage it, and issue new credentials (admin accounts, certificates and keys, and service accounts the device used). Verify: tmsh show sys version reports a fixed or current release, TMUI isn't reachable from untrusted networks, and the IoC checks come back clean. Sources: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-206a https://nvd.nist.gov/vuln/detail/CVE-2020-5902 https://my.f5.com/manage/s/article/K52145254