Vulnerabilidades do F5 BIG-IP
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam F5 BIG-IP: 88 registro(s), com versões afetadas e correções.
CVE-2025-54479
Alta · 7.5
CWE-787 15/10/2025
BIG-IP PEM vulnerability
When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-54755
Média · 4.9
CWE-22 15/10/2025
BIG-IP Configuration utility vulnerability
A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-48008
Alta · 7.5
CWE-416 15/10/2025
BIG-IP MPTCP vulnerability
When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-53868
Alta · 8.7
CWE-78 15/10/2025
BIG-IP SCP and SFTP vulnerability
When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-53856
Alta · 7.5
CWE-705 15/10/2025
TMM vulnerability
When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-53474
Alta · 7.5
CWE-120 15/10/2025
BIG-IP iRules vulnerability
When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-53521
Crítica · 9.8
KEV Alta · 60 CWE-121 15/10/2025
F5 BIG-IP Stack-Based Buffer Overflow Vulnerability
When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-46706
Alta · 7.5
CWE-770 15/10/2025
BIG-IP iRules vulnerability
When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-41430
Alta · 7.5
CWE-770 15/10/2025
BIG-IP SSL Orchestrator vulnerability
When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-47148
Média · 6.5
CWE-404 15/10/2025
BIG-IP APM and SSL Orchestrator vulnerability
When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2023-46747
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-306 26/10/2023
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2023-46748
Alta · 8.8
KEV Alta · 55 CWE-89 26/10/2023
F5 BIG-IP Configuration Utility SQL Injection Vulnerability
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which
may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2022-1388
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-306 05/05/2022
F5 BIG-IP Missing Authentication Vulnerability
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated