This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] F5 fixes 6 vulnerabilities in various products
F5 fixes 6 vulnerabilities in its products. The most severe of them are listed below; the remaining ones can be found at [1]. Individual products and their fixed versions: BIG-IP (all modules) - 17.1.2.2, 16.1.6, Hotfix-BIGIP-17.5.1.0.80.7-ENG.iso, Hotfix-BIGIP-17.1.2.2.0.259.12-ENG.iso, Hotfix-BIGIP-16.1.6.0.27.3-ENG.iso; BIG-IP (APM) - 17.1.2.2, 16.1.6; F5 Access for Android - 3.1.2; APM Clients - 7.2.5.3; NGINX Plus - R35, R34 P2, R33 P3, R32 P3; NGINX Open Source - 1.29.1. Detailed information on the fixed versions for the individual vulnerabilities can be found in the overview table at [1].
An unauthenticated remote attacker, due to anonymous Diffie-Hellman (ADH) ciphers being enabled in a Client SSL profile with SSL Forward Proxy active, is able to cause the Traffic Management Microkernel (TMM) process to crash and thus carry out a DoS attack. If an immediate update to a fixed version is not possible, the impact of the vulnerability can be temporarily mitigated by disabling ADH ciphers, for example by adding the "!ADH" parameter to the custom cipher suite configuration [2].
The vulnerability is present in product:
- *:BIG-IP; >=17.1.0, <=17.1.2; >=16.1.0, <=16.1.5, >=15.1.0, <=15.1.10
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-52585 at cve.org, NVD
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
An unauthenticated remote attacker, due to improper handling of traffic on a BIG-IP APM virtual server with Network Access enabled, is able to cause the TMM process to crash and thus carry out a DoS attack on the data plane [3].
The vulnerability is present in product:
- *:BIG-IP; >=17.1.0, <=17.1.2; >=16.1.0, <=16.1.5, >=15.1.0, <=15.1.10
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-46405 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
An unauthenticated remote attacker, due to the lack of remote endpoint identity verification in the F5 Access for Android application, is able to read and modify data transmitted over HTTPS in a man-in-the-middle attack [4].
The vulnerability is present in product:
- *:F5 Access for Android; >=3.1.0, <=3.1.1
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2025-54809 at cve.org, NVD
- CWE-295: Improper Certificate Validation at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
An authenticated local attacker, due to a missing file integrity check in the F5 VPN client installer for the browser on macOS, is able to replace the installation package with a malicious one, which may lead to a bypass of the endpoint inspection and privilege escalation. If an immediate update to a fixed version is not possible, the impact of the vulnerability can be temporarily mitigated by using BIG-IP Edge Client for macOS instead of the browser-based VPN client [5].
The vulnerability is present in products:
- BIG-IP; >=17.5.0, <=17.5.1; >=17.1.0, <=17.1.2; >=16.1.0, <=16.1.6; >=15.1.0, <=15.1.10
- *:APM Clients; =7.2.5
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-48500 at cve.org, NVD
- CWE-353: Missing Support for Integrity Check at cwe.mitre.org
The vulnerability was publicly disclosed 13. 8. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 21. 8. 2025.