NA - CVE-2025-22891 - When BIG-IP PEM Control Plane listener Virtual...
When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an...
NA - CVE-2025-23239 - When running in Appliance mode, an...
When running in Appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a...
NA - CVE-2025-23412 - When BIG-IP APM Access Profile is configured on...
When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS)...
NA - CVE-2025-23413 - When users log in through the webUI or API...
When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have...
NA - CVE-2025-23415 - An insufficient verification of data...
An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN...
NA - CVE-2025-23419 - When multiple server blocks are configured to...
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers....
NA - CVE-2025-24312 - When BIG-IP AFM is provisioned with IPS module...
When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosed traffic can cause an increase in CPU...
NA - CVE-2025-24319 - When BIG-IP Next Central Manager is running,...
When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate....
NA - CVE-2025-24320 - A stored cross-site scripting (XSS)...
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently...
NA - CVE-2025-24326 - When BIG-IP Advanced WAF/ASM Behavioral DoS...
When BIG-IP Advanced WAF/ASM Behavioral DoS (BADoS) TLS Signatures feature is configured, undisclosed traffic can case an increase in memory resource utilization. Note: Software versions which...