CVE-2015-3628

CVE-2015-3628 describes a privilege escalation vulnerability in the iControl API of various F5 BIG-IP and BIG-IQ products, including LTM, AFM, APM, and Cloud/Security, across several versions. Remote authenticated users with the "Resource Administrator" role can execute arbitrary commands with root privileges by injecting an iCall script or handler into a SOAP request. With a CVSS score of 9.0, this vulnerability is critical, allowing for complete compromise of confidentiality, integrity, and availability (C:C/I:C/A:C) with low attack complexity (AC:L) over the network (AV:N). While not listed on CISA KEV, public exploit code exists, specifically a Metasploit module, indicating a high potential for exploitation despite limited community discussion or media coverage.