F5 · BIG-IP
CVE-2025-53521
BigIP APM Vulnerability
Qué es
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CISA: F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
Qué hacer
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Plazo para las agencias federales de EE. UU.: 30 de marzo de 2026
Más fallos explotados de F5
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 10 may 2022 | Missing Authentication | BIG-IP | Crítica 9,8 | >99,9% |
| 3 nov 2021 | Traffic Management User Interface (TMUI) Remote Code Execution | BIG-IP | Crítica 9,8 | >99,9% |
| 22 sept 2026 | Heap-based Buffer Overflow | BIG-IP APM | Crítica 9,3 | 25% |
| 31 oct 2023 | Authentication Bypass | BIG-IP Configuration Utility | Crítica 9,8 | 97% |
| 31 oct 2023 | SQL Injection | BIG-IP Configuration Utility | Alto 8,8 | 4,2% |
| 18 ene 2022 | Buffer Overflow | BIG-IP Traffic Management Microkernel | Crítica 9,8 | 62% |
| 3 nov 2021 | iControl REST Remote Code Execution | BIG-IP and BIG-IQ Centralized Management | Crítica 9,8 | 99,9% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.