This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Actively exploited vulnerability in F5 BIG-IP APM
Based on evidence of active exploitation, CISA has added a critical vulnerability in F5 BIG-IP APM to its Known Exploited Vulnerabilities (KEV) catalog [1]. The vulnerability CVE-2025-53521 was originally classified as a DoS, but according to the latest analyses it allows RCE with the possibility of full system takeover [2]. If the malware c05d5254 is successfully deployed on a BIG-IP system, indicators of compromise (IoCs) may appear; a detailed list is available at [3]. We recommend updating immediately to the fixed versions 17.5.1.3, 17.1.3, 16.1.6.1 and 15.1.10.8, or to the latest available release [2].
Allows an unauthenticated remote attacker to execute code remotely and fully compromise the system by sending specific malicious traffic to a virtual server on which an APM access policy is configured [2].
The vulnerability is present in product:
- BIG-IP APM; >=17.5.0, <=17.5.1; >=17.1.0, <=17.1.2; >=16.1.0, <=16.1.6; >=15.1.0, <=15.1.10
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
More information:
- CVE-2025-53521 at cve.org, NVD
- CWE-121: Stack-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 15. 10. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 14. 4. 2026.