CVE-2025-24319: F5 BIG-IP Next Central Manager DOS Vulnerability

CVE-2025-24319 Overview

CVE-2025-24319 is a denial-of-service vulnerability in F5 BIG-IP Next Central Manager. Undisclosed requests sent to the BIG-IP Next Central Manager API can cause the Kubernetes service running on the Central Manager Node to terminate. The flaw is tracked under [CWE-20] Improper Input Validation and requires network access with low privileges to exploit.

F5 published the advisory on February 5, 2025. Software versions that have reached End of Technical Support (EoTS) were not evaluated. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
An authenticated remote attacker can terminate the Central Manager Node's Kubernetes service, disrupting management of F5 BIG-IP Next infrastructure.

Affected Products

F5 BIG-IP Next Central Manager (supported versions as listed in the vendor advisory)
Deployments exposing the Central Manager API to authenticated users
Kubernetes-backed Central Manager Node services

Discovery Timeline

2025-02-05 - CVE-2025-24319 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24319

Vulnerability Analysis

F5 BIG-IP Next Central Manager provides centralized management for BIG-IP Next instances through an API-driven control plane. The management services run as workloads on a Kubernetes cluster hosted on the Central Manager Node. The vulnerability allows specifically crafted API requests to force termination of these Kubernetes services.

When the service terminates, administrators lose the ability to configure, monitor, and orchestrate downstream BIG-IP Next instances. The data plane traffic handled by managed BIG-IP Next devices continues to flow, but centralized management operations stop until the service recovers.

F5 classifies this issue under [CWE-20] Improper Input Validation. The Central Manager API fails to adequately validate certain request content before passing it to the backend service, which then crashes.

Root Cause

The root cause is incomplete input validation on an undisclosed API endpoint exposed by BIG-IP Next Central Manager. F5 has not published the specific endpoint, parameter, or payload structure that triggers the condition. The malformed input propagates to the Kubernetes-hosted service, where it causes an unhandled error that terminates the process.

Attack Vector

Exploitation requires network reachability to the Central Manager API and valid low-privilege credentials. An attacker submits an undisclosed API request that the service fails to process safely. The underlying Kubernetes workload then exits, producing a denial-of-service condition against the management plane. No user interaction is required and attack complexity is low.

Refer to the F5 Support Article K000148412 for the authoritative technical description and affected version matrix.

Detection Methods for CVE-2025-24319

Indicators of Compromise

Unexpected restart or crash events for Kubernetes pods on the BIG-IP Next Central Manager Node
Repeated or anomalous API requests to the Central Manager management endpoints originating from a single authenticated principal
Loss of connectivity between the Central Manager and managed BIG-IP Next instances without a corresponding operator-initiated change

Detection Strategies

Monitor Central Manager application and Kubernetes event logs for container termination, CrashLoopBackOff states, and non-zero exit codes
Correlate API audit logs with service restart timestamps to identify requests that preceded a crash
Baseline normal API usage per account and alert on sudden spikes, malformed payloads, or requests to rarely used endpoints

Monitoring Recommendations

Forward Central Manager API audit logs and Kubernetes control-plane events to a centralized SIEM or data lake for correlation
Alert on repeated service terminations within a short window, which indicates attempted or successful exploitation
Track administrative session activity against the Central Manager and review any sessions associated with crash events

How to Mitigate CVE-2025-24319

Immediate Actions Required

Review the F5 Support Article K000148412 and identify affected Central Manager versions in your environment
Apply the fixed version published by F5 as soon as change windows permit
Restrict network access to the Central Manager API to trusted management networks and jump hosts
Audit all accounts with Central Manager API access and remove unused or over-privileged credentials

Patch Information

F5 has published fixed software versions in Support Article K000148412. Upgrade BIG-IP Next Central Manager to a release that is not listed as vulnerable in the advisory. Software versions beyond End of Technical Support are not evaluated and should be replaced with a supported release.

Workarounds

Limit API exposure by placing the Central Manager behind management-plane firewalls and VPN-only access
Enforce least-privilege role assignments so that only required automation and operator accounts can call the API
Enable rate limiting and anomaly detection on upstream load balancers or reverse proxies that front the Central Manager API

bash

# Example: restrict Central Manager API access to a management subnet using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP