CERT-In Vulnerability Note
CIVN-2025-0270
Multiple vulnerabilities in F5 products
Original Issue Date:October 17, 2025
Severity Rating: HIGH
Systems Affected
- BIG-IP (all modules) versions 17.5.0 – 17.5.1, 17.1.0 - 17.1.2, 16.1.0 - 16.1.6 and 15.1.0 - 15.1.10
- F5OS-A versions 1.8.1- 1.8.2 and 1.5.1 - 1.5.3
- F5OS-C versions 1.8.0 - 1.8.1 and 1.6.0 - 1.6.3
- BIG-IP Next SPK versions 1.7.0 - 1.9.2, 2.0.0 - 2.0.2
- BIG-IP Next CNF versions 1.1.0 - 1.4.1, 2.0.0 - 2.1.0
- BIG-IP SSL Orchestrator versions 17.5.0, 17.1.0 - 17.1.2, 16.1.0 - 16.1.5, 15.1.0 - 15.1.10
- BIG-IP ASM versions 17.1.0 - 17.1.2, 16.1.0 - 16.1.5
- BIG-IP PEM versions 17.5.0, 17.1.0 - 17.1.2, 16.1.0 - 16.1.6, 15.1.0 - 15.1.10
- BIG-IP Next for Kubernetes versions 2.0.0 - 2.1.0
- BIG-IP AFM versions 17.5.0, 17.1.0 - 17.1.2 and 15.1.0 - 15.1.10
- BIG-IP Advanced WAF/ASM versions 17.5.0 - 17.5.1, 17.1.0 - 17.1.2, 16.1.0 - 16.1.6, 15.1.0 - 15.1.10
- BIG-IP APM, APM with SWG, SSL Orchestrator, SSL Orchestrator with SWG versions 17.5.0 - 17.5.1, 17.1.0 - 17.1.2, 16.1.0 - 16.1.6, 15.1.0 - 15.1.10
- NGINX App Protect WAF versions 4.5.0 - 4.6.0
Overview
Multiple vulnerabilities have been reported in F5 products which could allow the attacker to perform cross-site scripting (XSS), information disclosure, privilege elevation, data manipulation and cause denial of service attacks on targeted system.
Target Audience:
All organizations and individuals using the affected F5 products.
Risk Assessment:
High risks of privilege elevation, Information disclosure and data manipulation.
Impact Assessment:
Potential impact on confidentiality, integrity, and availability of the system.
Description
Multiple vulnerabilities exist in F5 products. An authenticated attacker could exploit these vulnerabilities by accessing source code and configuration details of the targeted device.
Successful exploitation of these vulnerabilities could allow the attacker to perform cross-site scripting (XSS), information disclosure, privilege elevation, data manipulation and cause denial of service attacks on an affected system.
Solution
Apply appropriate updates as mentioned in:
https://my.f5.com/manage/s/article/K000156572
Vendor Information
F5
https://my.f5.com/manage/s/article/K000156572
References
F5
https://my.f5.com/manage/s/article/K000156572
CVE Name
CVE-2025-53868
CVE-2025-61955
CVE-2025-57780
CVE-2025-60016
CVE-2025-59781
CVE-2025-61951
CVE-2025-53856
CVE-2025-61974
CVE-2025-58071
CVE-2025-53521
CVE-2025-61960
CVE-2025-54854
CVE-2025-53474
CVE-2025-61900
CVE-2025-59778
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-22902657
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|