This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] F5 BIG-IP fixes 17 vulnerabilities in its products
F5 fixes 17 vulnerabilities in its products [1]. The most severe vulnerabilities are listed below. Individual products and their fixed versions: BIG-IP (all modules) - 17.1.2.1, 16.1.5.2, 15.1.10.6, Hotfix-BIGIP-16.1.5.2.0.7.5-ENG.iso, Hotfix-BIGIP-15.1.10.6.0.11.6-ENG.iso BIG-IP Next Central Manager - 20.3.0 BIG-IP Next SPK - 1.9.1, 1.7.7 BIG-IP Next CNF - 1.4.0 NGINX Plus - R33 P2, R32 P2 NGINX Open Source - 1.27.4, 1.26.3 Detailed information on the fixed versions for individual vulnerabilities can be found in the overview table at [1].
Allows an authenticated remote attacker to execute arbitrary system commands and create/delete files by sending specific requests via iControl REST in all BIG-IP modules. The vulnerability can be exploited in a similar way locally as well, using the tmsh command via the TMOS Shell. If it is not possible to update to a fixed version immediately, the risk can be temporarily mitigated by restricting access to the iControl REST interface and the command line over SSH to trusted networks and devices according to one of the procedures at [2].
The vulnerability is present in product:
- *:BIG-IP;>=15.1.0,<=15.1.10;>=16.1.0,<=16.1.5;>=17.1.0,<=17.1.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-20029 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an authenticated remote attacker with Administrator or Resource Administrator privileges [3] to execute arbitrary system commands and create/delete files via iControl REST in the Advanced Shell (bash) in all BIG-IP modules running in Appliance mode. If it is not possible to update to a fixed version immediately, the risk can be temporarily mitigated by restricting access to the iControl REST interface to trusted networks and devices according to one of the procedures at [4].
The vulnerability is present in product:
- *:BIG-IP;==17.1.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
More information:
- CVE-2025-23239 at cve.org, NVD
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an authenticated remote attacker, using social engineering, to perform a stored XSS attack in the Configuration utility in all BIG-IP modules [5]. This vulnerability is the result of an incomplete fix for vulnerability CVE-2024-31156 [6]. If it is not possible to update to a fixed version immediately, it is recommended to mitigate the risk by logging out of the utility after use, closing all browser instances, and using a separate browser for BIG-IP administration and other purposes [5].
The vulnerability is present in product:
- *:BIG-IP;>=15.1.0,<=15.1.10;>=16.1.0,<=16.1.5;>=17.1.0,<=17.1.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-24320 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Allows an unauthenticated remote attacker to perform a DoS attack in BIG-IP (all modules). The vulnerability is exploitable when Client SSL or Server SSL profiles are configured on a virtual server or when DNSSEC signing operations are active on the instance. If it is not possible to update to a fixed version immediately, it is recommended to configure the system in high availability (HA) mode to mitigate the risk [7].
The vulnerability is present in product:
- *:BIG-IP;>=15.1.0,<=15.1.10;>=16.1.0,<=16.1.5;>=17.1.0,<=17.1.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-21087 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
An unauthenticated remote attacker can carry out a DoS attack in BIG-IP (all modules) [8]. The vulnerability is exploitable when an Application Layer Gateway (ALG) profile for Session Initiation Protocol (SIP) with Passthru Mode enabled and a SIP Router ALG profile are configured on a Message Routing type virtual server. If it is not possible to update to a fixed version immediately, configuring the system in high availability (HA) mode is recommended to mitigate the risk [8].
The vulnerability is present in product:
- *:BIG-IP;>=15.1.0,<=15.1.10;>=16.1.0,<=16.1.4;>=17.1.0,<=17.1.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-20045 at cve.org, NVD
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 5. 2. 2025.
Links
- [1] https://my.f5.com/manage/s/article/K000149540
- [2] https://my.f5.com/manage/s/article/K000148587
- [3] https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-user-account-administration-11-6-0/3.html
- [4] https://my.f5.com/manage/s/article/K000138757
- [5] https://my.f5.com/manage/s/article/K000140578
- [6] https://my.f5.com/manage/s/article/K000138636
- [7] https://my.f5.com/manage/s/article/K000134888
- [8] https://my.f5.com/manage/s/article/K000138932
By CESNET, z.s.p.o. Michaela Ručková on 10. 2. 2025.