Critical Remote Code Execution in F5 BIG‑IP (CVE‑2025‑53521) Under Active Exploitation
What It Is — CVE‑2025‑53521, originally reported as a high‑severity denial‑of‑service bug in F5 BIG‑IP application delivery controllers, has been re‑evaluated as a remote code execution (RCE) flaw that allows unauthenticated attackers to run arbitrary commands on the underlying operating system.
Exploitability — Proof‑of‑concept exploits have been observed in the wild; threat actors are actively leveraging the flaw against unpatched deployments. The CVSS v3.1 base score is 9.8 (Critical).
Affected Products — All F5 BIG‑IP versions prior to the emergency patches released in March 2025, including the Traffic Management Operating System (TMOS) and associated modules (LTM, GTM, ASM).
TPRM Impact — The vulnerability can be weaponised against any organisation that relies on F5 BIG‑IP for load balancing, web‑application delivery, or VPN access, creating a direct supply‑chain risk. Successful exploitation may lead to credential theft, lateral movement, and exposure of downstream data.
Recommended Actions —
- Deploy the March 2025 emergency patches for all BIG‑IP appliances immediately.
- Verify that the “disable‑http‑request‑smuggling” hardening flag is enabled.
- Conduct network‑level segmentation to limit inbound traffic to management interfaces.
- Monitor F5 logs for anomalous command‑execution patterns and indicator‑of‑compromise (IOC) signatures.
- Review third‑party contracts to confirm that service providers have applied the fix.
Source: Dark Reading