Vulnerabilidades de F5

CVEs publicadas que afetam produtos de F5: 160 registro(s), com severidade, exploração e correções.

BIG-IP 88 Big-ip Access Policy Manager 79 Big-ip Application Security Manager 78 Big-ip Advanced Firewall Manager 71 Big-ip Advanced Web Application Firewall 71 Big-ip Policy Enforcement Manager 71 Big-ip Local Traffic Manager 70 Big-ip Analytics 70 Big-ip Application Acceleration Manager 70 Big-ip Global Traffic Manager 70 Big-ip Link Controller 70 Big-ip Domain Name System 69 Big-ip Webaccelerator 66 Big-ip Ssl Orchestrator 65 Big-ip Ddos Hybrid Defender 65 Big-ip Fraud Protection Service 65 Big-ip Edge Gateway 63 Big-ip Container Ingress Services 61 Big-ip Application Visibility And Reporting 61 Big-ip Websafe 61 Big-ip Carrier-grade Nat 61 Big-ip Automation Toolchain 60 Nginx Open Source 26 Nginx Plus 25 Nginx Ingress Controller 22 Nginx Gateway Fabric 21 Big-ip Next Cloud-native Network Functions 16 BIG-IP Next CNF 16 Nginx Instance Manager 13 Big-ip Next For Kubernetes 12 Waf 12 BIG-IP Next SPK 12 Big-ip Next Service Proxy For Kubernetes 12 Big-iq Centralized Management 11 BIG-IQ 10 Dos 8 F5OS - Appliance 6 NGINX JavaScript 6 F5os-a 6 F5OS - Chassis 5

Somente exploradas (KEV) →

CVE-2025-58153 Média · 5.9 CWE-667 15/10/2025

BIG-IP HSB vulnerability

Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge (HSB) may experience a lockup of the HSB. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-58096 Alta · 7.5 CWE-787 15/10/2025

BIG-IP TMM vulnerability

When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-55670 Média · 6.5 CWE-770 15/10/2025

BIG-IP Next (CNF, SPK, and Kubernetes) vulnerability

On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes systems, repeated undisclosed API calls can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-55669 Alta · 7.5 CWE-672 15/10/2025

BIG-IP HTTP/2 vulnerability

When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-55036 Alta · 7.5 CWE-787 15/10/2025

BIG-IP SSL Orchestrator vulnerability

When BIG-IP SSL Orchestrator explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled, undisclosed traffic may cause memory corruption. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-54858 Alta · 7.5 CWE-674 15/10/2025

BIG-IP Advanced WAF and ASM vulnerability

When a BIG-IP Advanced WAF or BIG-IP ASM Security Policy is configured with a JSON content profile that has a malformed JSON schema, and the security policy is applied to a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-54854 Alta · 7.5 CWE-125 15/10/2025

BigIP APM Vulnerability

When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-54805 Média · 6.5 CWE-401 15/10/2025

TMM Vulnerability

When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can cause an increase in the Traffic Management Microkernel (TMM) memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-54479 Alta · 7.5 CWE-787 15/10/2025

BIG-IP PEM vulnerability

When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-54755 Média · 4.9 CWE-22 15/10/2025

BIG-IP Configuration utility vulnerability

A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-48008 Alta · 7.5 CWE-416 15/10/2025

BIG-IP MPTCP vulnerability

When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-53868 Alta · 8.7 CWE-78 15/10/2025

BIG-IP SCP and SFTP vulnerability

When running in Appliance mode, a highly privileged authenticated attacker with access to SCP and SFTP may be able to bypass Appliance mode restrictions using undisclosed commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-53856 Alta · 7.5 CWE-705 15/10/2025

TMM vulnerability

When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-53474 Alta · 7.5 CWE-120 15/10/2025

BIG-IP iRules vulnerability

When an iRule using an ILX::call command is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-53521 Crítica · 9.8 KEV Alta · 60 CWE-121 15/10/2025

F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-47150 Média · 6.5 CWE-401 15/10/2025

F5OS SNMP vulnerability

When SNMP is configured on F5OS Appliance and Chassis systems, undisclosed requests can cause an increase in SNMP memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-46706 Alta · 7.5 CWE-770 15/10/2025

BIG-IP iRules vulnerability

When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-41430 Alta · 7.5 CWE-770 15/10/2025

BIG-IP SSL Orchestrator vulnerability

When BIG-IP SSL Orchestrator is enabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2025-47148 Média · 6.5 CWE-404 15/10/2025

BIG-IP APM and SSL Orchestrator vulnerability

When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2023-46747 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-306 26/10/2023

F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVE-2023-46748 Alta · 8.8 KEV Alta · 55 CWE-89 26/10/2023

F5 BIG-IP Configuration Utility SQL Injection Vulnerability

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVE-2023-44487 Alta · 7.5 KEV Urgente · 73 Exploit público CWE-400 10/10/2023

HTTP/2 Rapid Reset Attack Vulnerability

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2022-29263 Alta · 7.8 CWE-732 05/05/2022

Incorrect Permission Assignment for Critical Resource em F5 Access Policy Manager Clients

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVE-2022-1388 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-306 05/05/2022

F5 BIG-IP Missing Authentication Vulnerability

On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVE-2021-40438 Crítica · 9.0 KEV Urgente · 83 Exploit público Ransomware CWE-918 16/09/2021

Apache HTTP Server-Side Request Forgery (SSRF)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.