F5 BIG-IP APM Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-53521)

1. Apply Official Patches

Refer to the official F5 security advisory [K000156741] and upgrade to the recommended hotfix or patched version immediately.

2. Temporary Mitigations

If immediate patching is not feasible, implement the following measures:

• Access Control Lists (ACLs): Restrict access to the APM virtual servers to trusted IP ranges only.
• WAF/ASM Signatures: Deploy and enable specific signature rules on BIG-IP Advanced WAF to detect and block anomalous HTTP/TMM traffic.
• iRules Mitigation: Apply an iRule to drop requests with abnormally large headers or payloads.

# Example iRule to reject oversized HTTP requests
when HTTP_REQUEST {
    if { [string length [HTTP::release]] > 8192 } {
        reject
    }
}

This vulnerability (CVE-2025-53521) is a Critical-severity (CVSS 9.8) Remote Code Execution vulnerability affecting the F5 BIG-IP APM (Access Policy Manager) module.

Root Cause & Attack Mechanics

• Stack-based Buffer Overflow (CWE-121): When a BIG-IP APM access policy is active on a virtual server, the system fails to properly validate the length of incoming protocol headers or payloads, leading to a stack-based buffer overflow.
• Unauthenticated Exploitation: An attacker does not require any prior authentication or privileges to exploit this vulnerability; sending a crafted malicious packet over the network is sufficient.
• Active Exploitation: This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog and has an EPSS score of 0.94, indicating high active exploitation in the wild.