CVE-2025-53521

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 2,3%

Kerentanan Stack-based Buffer Overflow pada f5 big-ip access policy manager. Skor CVSS 3.1 9.8 (Critical) menurut f5.com. Masuk katalog KEV CISA pada 27 Maret 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Rincian

Terbit di NVD

15 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber f5.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

F5 BIG-IP Stack-Based Buffer Overflow Vulnerability

Masuk KEV

27 Maret 2026

Tenggat CISA

30 Maret 2026 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://my.f5.com/manage/s/article/K000156741 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521 pemerintah AS