Vulnerabilidades de F5

CVEs publicadas que afetam produtos de F5: 160 registro(s), com severidade, exploração e correções.

BIG-IP 88 Big-ip Access Policy Manager 79 Big-ip Application Security Manager 78 Big-ip Advanced Firewall Manager 71 Big-ip Advanced Web Application Firewall 71 Big-ip Policy Enforcement Manager 71 Big-ip Local Traffic Manager 70 Big-ip Analytics 70 Big-ip Application Acceleration Manager 70 Big-ip Global Traffic Manager 70 Big-ip Link Controller 70 Big-ip Domain Name System 69 Big-ip Webaccelerator 66 Big-ip Ssl Orchestrator 65 Big-ip Ddos Hybrid Defender 65 Big-ip Fraud Protection Service 65 Big-ip Edge Gateway 63 Big-ip Container Ingress Services 61 Big-ip Application Visibility And Reporting 61 Big-ip Websafe 61 Big-ip Carrier-grade Nat 61 Big-ip Automation Toolchain 60 Nginx Open Source 26 Nginx Plus 25 Nginx Ingress Controller 22 Nginx Gateway Fabric 21 Big-ip Next Cloud-native Network Functions 16 BIG-IP Next CNF 16 Nginx Instance Manager 13 Big-ip Next For Kubernetes 12 Waf 12 BIG-IP Next SPK 12 Big-ip Next Service Proxy For Kubernetes 12 Big-iq Centralized Management 11 BIG-IQ 10 Dos 8 F5OS - Appliance 6 NGINX JavaScript 6 F5os-a 6 F5OS - Chassis 5

Somente exploradas (KEV) →

CVE-2025-61990 Alta · 7.5 CWE-415 15/10/2025

TMM vulnerability

When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-58071 Alta · 7.5 CWE-457 15/10/2025

BIG-IP IPSec vulnerability

When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-61935 Alta · 7.5 CWE-252 15/10/2025

BIG-IP Advanced WAF and ASM vulnerability

When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-61933 Média · 6.1 CWE-79 15/10/2025

BIG-IP APM cross-site scripting (XSS) vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-57780 Alta · 8.8 CWE-250 15/10/2025

F5OS Vulnerability

A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-53860 Média · 4.1 CWE-214 15/10/2025

F5OS-A FIPS HSM vulnerability

A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module (HSM) information on F5 rSeries systems. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-61974 Alta · 7.5 CWE-401 15/10/2025

BIG-IP SSL/TLS vulnerability

When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-61960 Alta · 7.5 CWE-476 15/10/2025

BIG-IP APM portal access vulnerability

When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-61958 Alta · 8.7 CWE-250 15/10/2025

BIG-IP TMSH vulnerability

A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a bash shell. For BIG-IP systems running in Appliance mode, a successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-61955 Alta · 8.8 CWE-95 15/10/2025

F5OS vulnerability

A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-60016 Alta · 7.5 CWE-119 15/10/2025

BIG-IP SSL/TLS vulnerability

When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher Group, and that profile is applied to a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-60015 Média · 5.7 CWE-787 15/10/2025

F5OS out-of-bounds write vulnerability

An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-61951 Alta · 7.5 CWE-125 15/10/2025

BIG-IP DTLS 1.2 Vulnerability

Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is enabled with a Server SSL profile that is configured with a certificate, key, and the SSL Sign Hash set to ANY, and the backend server is enabled with DTLS 1.2 and client authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-61938 Alta · 7.5 CWE-1284 15/10/2025

BIG-IP Advanced WAF and ASM bd process vulnerability

When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repeatedly. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-59781 Alta · 7.5 CWE-459 15/10/2025

BIG-IP DNS cache vulnerability

When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-60013 Média · 4.6 CWE-78 15/10/2025

F5OS-A FIPS HSM password vulnerability

When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module (HSM) may fail to initialize. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-59778 Alta · 7.5 CWE-770 15/10/2025

VELOS partition container network vulnerability

When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-59483 Média · 6.5 CWE-73 15/10/2025

BIG-IP Configuration utility and tmsh vulnerability

A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-59481 Alta · 8.7 CWE-250 15/10/2025

BIG-IP iControl REST and tmsh vulnerability

A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to execute arbitrary system commands with higher privileges. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-59478 Alta · 7.5 CWE-824 15/10/2025

BIG-IP AFM DoS protection profile vulnerability

When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-58474 Média · 5.3 CWE-770 15/10/2025

BIG-IP Advanced WAF and ASM and NGINX App Protect DNS lookup vulnerability

When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-59269 Média · 6.1 CWE-79 15/10/2025

BIG-IP Configuration utility XSS vulnerability

A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-59268 Média · 5.3 CWE-201 15/10/2025

BIG-IP Configuration utility vulnerability

On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attacker through the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-58120 Alta · 7.5 CWE-476 15/10/2025

BIG-IP Next (CNF, SPK, and Kubernetes) vulnerability

When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-58424 Média · 5.3 CWE-340 15/10/2025

BIG-IP TMM vulnerability

On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data modification in protocols which do not have message integrity protection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.