Last Modified: Feb 03, 2026
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
17.1.3, 17.1.3.1
Opened: Jan 26, 2026 Severity: 3-Major
User creation succeeds in BIG-IP TMUI and tmsh when the username is composed of digits only (e.g., 222, 7654). SFTP login attempts fail for these numeric only accounts when connecting via management IP or self IP. Mixed alphanumeric usernames (e.g., b222, 583491b) work correctly for SFTP.
Authentication Failures: Numeric-only usernames created via TMUI/tmsh cannot be used for SFTP access to BIG-IP management or self IPs. This leads to failed logins. Operational Confusion: Administrators may assume these accounts are valid since creation succeeds, but later encounter unexplained failures when attempting remote access.
For numeric-only usernames (e.g., 222, 583491) account creation succeeds, but SFTP login fails. For alphanumeric usernames (e.g., b222, 583491b) account creation succeeds, and SFTP login works.
Avoid numeric?only usernames: Administrators should not create accounts consisting solely of digits (e.g., 222,583491). Use alphanumeric usernames: Ensure that all usernames contain at least one non?numeric character (e.g., b222, user123). These accounts work correctly with SFTP.
None