CVE-2015-3628: F5 BIG-IP iControl iCall privilege escalation to root

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityA network-reachable privilege escalation with public exploit code and very high EPSS, though it requires an authenticated Resource Administrator account and is not in KEV.

What it is

The iControl API in multiple F5 BIG-IP and BIG-IQ products fails to properly restrict the iCall script and handler functionality, letting a remote authenticated user with the Resource Administrator role execute privileged operations. Because that role is meant to be limited, the flaw breaks the intended privilege boundary and can yield full control of the affected appliance.

Impact

An attacker with a low-privileged Resource Administrator account gains elevated privileges, up to root-level command execution on the device, compromising the confidentiality, integrity and availability of the managed traffic and configuration.

Attack surface

Reached over the network through a SOAP request to iControl/iControlPortal.cgi using an iCall script or handler. Authentication is required, but only at the Resource Administrator role, and no user interaction is needed.

Exploitation

Public exploit code exists (Packet Storm, Rapid7, Exploit-DB references tagged Exploit), and EPSS is 0.68483 (99.3rd percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the F5 fixed versions: 11.5.3 HF2 or later for 11.3.0-11.5.x, and 11.6.0 HF6 or later for 11.6.0, per vendor advisory SOL16728.
• Restrict and audit accounts holding the Resource Administrator role; remove it from users who do not need it.
• Limit network access to the iControl/iControlPortal.cgi management interface to trusted administrative networks.
• Monitor and alert on unexpected iCall script or handler creation and on SOAP requests to iControl endpoints.
• If patching is delayed, disable or tightly control iCall functionality where operationally feasible.

Detection

• Audit iControl SOAP requests to iControlPortal.cgi for iCall script or handler creation, especially from Resource Administrator accounts.
• Monitor for new or modified iCall scripts and handlers on BIG-IP/BIG-IQ systems.
• Alert on processes or commands spawned by the iControl service that indicate privilege escalation or shell execution.
• Review authentication logs for Resource Administrator logins from unusual sources or at unusual times.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.