A cross‑site request forgery (CSRF) vulnerability exists in the dashboard of the BIG‑IP Configuration utility. When an authenticated user visits a malicious site, the attacker can trick the browser into submitting unauthorized requests, potentially changing device settings or executing privileged operations without the user’s knowledge. This flaw undermines the integrity of the configuration and could enable further compromise if the attacker gains sufficient configuration privileges.

The vulnerability affects F5 BIG‑IP systems. No specific product versions are listed, and software that has reached End of Technical Support is not evaluated.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is unavailable and the issue is not listed in the CISA KEV catalog. CSRF attacks typically require the victim to be authenticated and to have an active browser session, so the exploitability depends on the attacker's ability to lure an authenticated user to a malicious site. The moderate score suggests that while exploitation is possible, it is not automatically critical.