Critical Remote Code Execution in F5 BIG‑IP (CVE‑2025‑53521) Actively Exploited
What It Is – A flaw in F5 BIG‑IP’s Traffic Management Operating System (TMOS) that was originally disclosed as a high‑severity denial‑of‑service issue has been re‑evaluated and confirmed to allow unauthenticated remote code execution (RCE). The vulnerability (CVE‑2025‑53521) can be triggered over HTTP/HTTPS, granting attackers full control of the appliance.
Exploitability – Public proof‑of‑concept code and multiple threat‑intel feeds indicate the vulnerability is being weaponised in the wild. CVSS v3.1 base score is 9.8 (Critical).
Affected Products – All F5 BIG‑IP versions prior to the emergency patches released in March 2025, including LTM, GTM, and ASM modules. Specific affected releases are listed in F5’s advisory (e.g., 16.1.x, 17.0.x, 18.1.x, 19.2.x).
TPRM Impact – Enterprises that rely on F5 BIG‑IP for load balancing, web‑application firewall, or DNS services expose their entire network surface to a compromised third‑party component. A successful RCE can be leveraged to pivot into downstream applications, exfiltrate data, or disrupt critical services, creating a supply‑chain risk that extends to customers and partners.
Recommended Actions –
- Apply F5’s emergency patches immediately (or upgrade to a fixed version).
- Enable the temporary mitigation published by F5 (IP‑based access controls, disabling unused virtual servers).
- Conduct a rapid inventory of all BIG‑IP appliances across the organization and any managed service providers.
- Monitor logs for anomalous traffic to the BIG‑IP management interface (unexpected HTTP methods, outbound connections from the appliance).
- Validate segmentation – ensure the BIG‑IP control plane is isolated from sensitive data stores.
Source: Dark Reading – F5 BIG‑IP Vulnerability Reclassified as RCE, Under Exploitation