DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
F5 BIG-IP und F5OS: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-10-15
Ein Angreifer kann mehrere Schwachstellen in F5 BIG-IP und F5 F5OS ausnutzen, um Sicherheitsmechanismen zu umgehen, seine Privilegien zu erhöhen, einen Denial-of-Service-Zustand (DoS) herbeizuführen, einen Cross-Site-Scripting-Angriff (XSS) durchzuführen und Informationen offenzulegen oder zu manipulieren, sowie um Code auszuführen.
01
beschreibt (44)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-61990US | — | — | ||
When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which hav… | ||||
| CVE-2025-61935US | — | — | ||
When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have… | ||||
| CVE-2025-61933US | — | — | ||
A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out… | ||||
| CVE-2025-58071US | — | — | ||
When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End… | ||||
| CVE-2025-57780US | — | — | ||
A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the atta… | ||||
| CVE-2025-53860US | medium4.1 | — | ||
A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module (HSM) information on F5 rSeries s… | ||||
| CVE-2025-61974US | — | — | ||
When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached… | ||||
| CVE-2025-61960US | — | — | ||
When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: So… | ||||
| CVE-2025-61958US | high8.7 | — | ||
A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass tmsh restrictions and gain access to a… | ||||
| CVE-2025-61955US | — | — | ||
A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the att… | ||||
| CVE-2025-61951US | — | — | ||
Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is ena… | ||||
| CVE-2025-61938US | — | — | ||
When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually… | ||||
| CVE-2025-60016US | — | — | ||
When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher Group, and that profile is applied to a v… | ||||
| CVE-2025-60015US | — | — | ||
An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption.
Note: Software versions which have reached End of Technical Support (Eo… | ||||
| CVE-2025-60013US | — | Exploit | ||
When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be… | ||||
| CVE-2025-59781US | — | — | ||
When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization. Note: Software versions… | ||||
| CVE-2025-59778US | — | — | ||
When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate.
Note: Software version… | ||||
| CVE-2025-59483US | medium6.5 | — | ||
A validation vulnerability exists in an undisclosed URL in the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | ||||
| CVE-2025-59481US | high8.7 | — | ||
A vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (tmsh) command that may allow an authenticated attacker with at least resource administrator role to ex… | ||||
| CVE-2025-59478US | — | — | ||
When a BIG-IP AFM denial-of-service (DoS) protection profile is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to t… | ||||
20 von 44 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- F5 Security Incident Notification vom 2025-10-15external
- F5 Quarterly Security Notification October 2025 vom 2025-10-15external
- F5 Security Advisory K000156741 vom 2026-04-01external
- National Vulnerability Database CVE-2025-53521 vom 2026-03-31external
- WID-SEC-W-2025-2310 - CSAF Versionself
- WID-SEC-2025-2310 - Portal Versionself
- CISA Known Exploited Vulnerabilities Catalog vom 2026-03-29external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan