CVSS: 3.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-23415 – BIG-IP APM Endpoint Inspection vulnerability
https://notcve.org/view.php?id=CVE-2025-23415
05 Feb 2025 — An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN client for Windows, macOS and Linux. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K000139656 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 8.7EPSS: 0%CPEs: 3EXPL: 0CVE-2025-21091 – BIG-IP SNMP vulnerability
https://notcve.org/view.php?id=CVE-2025-21091
05 Feb 2025 — When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated • https://my.f5.com/manage/s/article/K000140933 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 8.9EPSS: 0%CPEs: 4EXPL: 0CVE-2025-21087 – TMM Vulnerability
https://notcve.org/view.php?id=CVE-2025-21087
05 Feb 2025 — When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated • https://my.f5.com/manage/s/article/K000134888 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2024-45844 – BIG-IP monitors vulnerability
https://notcve.org/view.php?id=CVE-2024-45844
16 Oct 2024 — BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. La función de monitorización de BIG-IP puede permitir que un atacante eluda las restricciones de control de acceso, independientemente de la configuración de bloqueo de puertos. Nota: Las versiones de software que han alcanzado el fin del soporte técnico (EoTS) no se evalúan. • https://my.f5.com/manage/s/article/K000140061 • CWE-306: Missing Authentication for Critical Function •
CVSS: 8.2EPSS: 0%CPEs: 5EXPL: 0CVE-2024-41164 – BIG-IP MPTCP vulnerability
https://notcve.org/view.php?id=CVE-2024-41164
14 Aug 2024 — When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K000138477 • CWE-476: NULL Pointer Dereference •
CVSS: 8.7EPSS: 0%CPEs: 3EXPL: 0CVE-2024-39778 – BIG-IP HSB vulnerability
https://notcve.org/view.php?id=CVE-2024-39778
14 Aug 2024 — When a stateless virtual server is configured on BIG-IP system with a High-Speed Bridge (HSB), undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K05710614 • CWE CATEGORY •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-41723 – BIG-IP iControl REST vulnerability
https://notcve.org/view.php?id=CVE-2024-41723
14 Aug 2024 — Undisclosed requests to BIG-IP iControl REST can lead to information leak of user account names. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. • https://my.f5.com/manage/s/article/K10438187 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-31156 – BIG-IP Configuration utility XSS vulnerability
https://notcve.org/view.php?id=CVE-2024-31156
08 May 2024 — A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Existe una vulnerabilidad de cross site scripting (XSS) almacenado en una página no divulgada de la utilidad de configuración BIG-IP que permite a un atacante ejecutar JavaScript en el contexto del usuario actual... • https://my.f5.com/manage/s/article/K000138636 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2024-33604 – BIG-IP Configuration utility XSS vulnerability
https://notcve.org/view.php?id=CVE-2024-33604
08 May 2024 — A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Existe una vulnerabilidad de cross site scripting (XSS) reflejado en una página no revelada de la utilidad de configuración BIG-IP que permite a un atacante ejecutar JavaScript en el contexto del usuario actualment... • https://my.f5.com/manage/s/article/K000138894 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2024-28889 – BIG-IP SSL vulnerability
https://notcve.org/view.php?id=CVE-2024-28889
08 May 2024 — When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Cuando un perfil SSL con tieF5 Networksmpo de espera de alerta se configura con un valor no predeterminado en un servidor virtual, el tráfico no divulgado junto con condiciones fuera... • https://my.f5.com/manage/s/article/K000138912 • CWE-825: Expired Pointer Dereference •