CVE-2025-21091

When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-21091

When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-20029

Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-20058

When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-20029

Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-20058

When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-23413

The CVE-2025-23413 vulnerability affects BIG-IP Next Central Manager. When users authenticate locally via webUI/API, sensitive data can be logged in pgaudit logs. Exploitation could allow an authenticated attacker with Administrator role to read undisclosed sensitive information through pgaudit. ...

CVE-2025-20029

CVE-2025-20029 is a command-injection vulnerability in BIG-IP iControl REST and the tmsh shell. An authenticated user could execute arbitrary system commands, e.g., via a crafted HTTP POST to the iControl REST endpoint /mgmt/tm/util/bash with a JSON payload such as {"command": "id"}, potentially ...

CVE-2025-24319

CVE-2025-24319 affects BIG-IP Next Central Manager. The issue is an input validation error in the Central Manager API that can be exploited by an authenticated, low-privilege user to terminate the Kubernetes service on the Central Manager node, impacting availability. Root cause: mishandling of A...

CVE-2025-24319 BIG-IP Next Central Manager vulnerability

When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-24319 BIG-IP Next Central Manager vulnerability

When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-20029 BIG-IP iControl REST and tmsh vulnerability

Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-23413 BIG-IP Next Central Manager vulnerability

When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-23413 BIG-IP Next Central Manager vulnerability

When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-20029 BIG-IP iControl REST and tmsh vulnerability

Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell tmsh save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-24497 BIG-IP PEM vulnerability

When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-24497

CVE-2025-24497 affects BIG-IP PEM urbanized vulnerability context: when URL categorization is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate, yielding a DoS on the data plane. Exploitation requires PEM provisioned BIG-IP with U...

CVE-2025-24320 BIG-IP Configuration utility vulnerability

A stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for CVE-2024-31156...

CVE-2025-24320

CVE-2025-24320 is a stored XSS vulnerability in the BIG-IP Configuration utility. It arises from an incomplete fix for CVE-2024-31156. Affected: BIG-IP Configuration utility (across multiple tracks/branches). Impact: allows an attacker to store and execute JavaScript in the context of the logged-...

CVE-2025-24497 BIG-IP PEM vulnerability

When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...