Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 85

CVE-2024-32761

BIG-IP TMM tenants on VELOS and rSeries vulnerability

Under certain conditions, a data leak may occur in the Traffic Management Microkernels (TMMs) of BIG-IP tenants running on VELOS and rSeries platforms. This leak occurs randomly and cannot be deliberately triggered. If it occurs, it may leak up to 64 bytes of non-contiguous randomized bytes. Under rare conditions, this may lead to a TMM restart, affecting availability.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2025-54755

BIG-IP Configuration utility vulnerability

A directory traversal vulnerability exists in TMUI that allows a highly privileged authenticated attacker to access files which are not limited to the intended files.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 6.9 Medium EPSS 1.2% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2024-31156

BIG-IP Configuration utility XSS vulnerability

A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2023-46747

BIG-IP Configuration utility unauthenticated remote code execution vulnerability

Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 9.8 Critical EPSS 96.7% KEV · Listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 17 more
CVE-2023-46748

BIG-IP Configuration utility authenticated SQL injection vulnerability

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 8.8 High EPSS 4.3% KEV · Listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 17 more
CVE-2024-27202

BIG-IP TMUI XSS vulnerability

A DOM-based cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2024-28889

BIG-IP SSL vulnerability

When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2025-41433

BIG-IP SIP ALG profile vulnerability

When a Session Initiation Protocol (SIP) message routing framework (MRF) application layer gateway (ALG) profile is configured on a Message Routing virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2025-41399

SCTP Vulnerability

When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 22 more
CVE-2025-36504

BIG-IP HTTP/2 vulnerability

When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 22 more
CVE-2025-52585

BIG-IP Client SSL profile vulnerability

When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2025-20045

BIG-IP SIP MRF Vulnerability

When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2025-20058

BIG-IP message routing vulnerability

When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more
CVE-2025-21087

TMM Vulnerability

When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 20 more
CVE-2024-33604

BIG-IP Configuration utility XSS vulnerability

A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 19 more