CVE-2025-53521

The vulnerability is classified as CWE-121 (stack-based buffer overflow). When an APM access policy is configured on a BIG-IP virtual server, specially crafted malicious network traffic can overflow a stack buffer, leading to control flow hijacking of the process. The attack requires no authentication, user interaction, or special preconditions — an attacker only needs network access to the interface served by the vulnerable virtual server.

An attacker can achieve remote code execution (RCE) on an F5 BIG-IP device, which in practice means complete takeover of the device, including potential access to managed network traffic, user authentication credentials using APM, and internal infrastructure.

Immediately apply patches available from the vendor according to the official F5 article K000156741 (https://my.f5.com/manage/s/article/K000156741). Until the patch is deployed, consider restricting network access to virtual servers with APM configuration to trusted IP addresses only and monitor anomalous traffic directed to these services.

F5 BIG-IP Access Policy Manager (APM) — versions specified in vendor references (versions under technical support); the virtual server must have an APM access policy configured. Versions that have reached end of technical support (EoTS) are not covered by this assessment.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.