Multiple F5 BIG-IP Products Vulnerabilities

October 21, 2025

Severity

High

Analysis Summary

CVE-2025-61933 CVSS:6.1

F5 BIG-IP is vulnerable to reflected cross-site scripting, caused by improper validation of user-supplied input

CVE-2025-59483 CVSS:6.5

F5 BIG-IP could allow a remote authenticated attacker to obtain sensitive information, caused by a validation exists in an undisclosed URL in the Configuration utility.

CVE-2025-59481 CVSS:8.7

F5 BIG-IP could allow a remote authenticated attacker to execute arbitrary system commands on the system, caused by an unspecified flaw in the iControl REST and BIG-IP TMOS Shell (tmsh) command.

CVE-2025-61974 CVSS:7.5

F5 BIG-IP is vulnerable to a denial of service, caused by a memory leak flaw.

CVE-2025-61958 CVSS:8.7

F5 BIG-IP could allow a remote authenticated attacker to bypass tmsh restrictions and gain access to the Advanced Shell (bash), caused by a flaw in the iHealth utility of the TMOS Shell (tmsh).

CVE-2025-58096 CVSS:7.5

F5 BIG-IP is vulnerable to a denial of service, caused by an out-of-bounds write flaw

CVE-2025-61938 CVSS:7.5

F5 BIG-IP is vulnerable to a denial of service, caused by a way to terminate bd process repeatedly, when security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting.

CVE-2025-55036 CVSS:7.5

F5 BIG-IP SSL Orchestrator is vulnerable to a denial of service, caused by a memory corruption flaw when explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled.

CVE-2025-60016 CVSS:7.5

F5 BIG-IP is vulnerable to a denial of service, caused by a way to terminateTraffic Management Microkernel (TMM), when Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher Group.

CVE-2025-55669 CVSS:7.5

F5 BIG-IP ASM is vulnerable to a denial of service, caused by a way to terminate Traffic Management Microkernel (TMM), when the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server.

Impact