Skip to content
Fencer Intel
critical 9.0

CVE-2015-3628 in the critical feed json

The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6…

published 2015-12-07 10 y ago modified 2026-06-17 4 mo ago also EUVD-2015-3669

cvss
9.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
69.3%
EPSS 69.3% chance of exploitation in 30 days, percentile 99.3%
public exploits
2
Metasploit, Exploit-DB

Summary

The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0 before 11.6.0 HF6, BIG-IP PSM 11.3.0 through 11.4.1, Enterprise Manager 3.1.0 through 3.1.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote authenticated users with the "Resource Administrator" role to gain privileges via an iCall (1) script or (2) handler in a SOAP request to iControl/iControlPortal.cgi.

Timeline

  1. First public exploit (Metasploit exploit/linux/http/f5_icall_cmd)
  2. Published

Exploit prediction

69.27% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/linux/http/f5_icall_cmd F5 iControl iCall::Script Root Command Execution metasploit exploit, excellent rank, 2015-09-03
  • EDB-38764 F5 iControl - 'iCall::Script' Root Command Execution (Metasploit) remote, 2015-11-19
  • rapid7.com http://www.rapid7.com/db/modules/exploit/linux/http/f5_icall_cmd referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/134434/F5-iControl-iCall-Script-Root-Command-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.