CVE-2025-58153: F5 BIG-IP Access Policy Manager DoS Flaw

CVE-2025-58153 Overview

CVE-2025-58153 affects F5 BIG-IP hardware systems equipped with a High-Speed Bridge (HSB). Under undisclosed traffic conditions combined with additional conditions outside the attacker's control, the HSB may enter a lockup state. The result is a denial-of-service condition on the affected appliance, disrupting traffic processing across BIG-IP modules including Local Traffic Manager, Access Policy Manager, Advanced Firewall Manager, and other services that rely on the hardware data path. F5 tracks this issue under security article K000151658. Software versions that have reached End of Technical Support (EoTS) are not evaluated. The weakness is classified as [CWE-667] Improper Locking.

Critical Impact
A network-reachable attacker may trigger a lockup of the High-Speed Bridge on affected BIG-IP hardware, disrupting availability of all traffic-handling modules on the appliance.

Affected Products

F5 BIG-IP hardware platforms running affected software versions, including 17.5.0
BIG-IP modules: Local Traffic Manager (LTM), Access Policy Manager (APM), Advanced Firewall Manager (AFM), Advanced WAF, ASM, Analytics, and Application Acceleration Manager
BIG-IP modules: Carrier-Grade NAT, DDoS Hybrid Defender, DNS, Global Traffic Manager, Link Controller, Policy Enforcement Manager, SSL Orchestrator, WebAccelerator, and WebSafe

Discovery Timeline

2025-10-15 - CVE-2025-58153 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58153

Vulnerability Analysis

CVE-2025-58153 is a hardware-level denial-of-service condition affecting BIG-IP appliances that include a High-Speed Bridge component. The HSB is responsible for shuttling packets between the traffic management microkernel and network interfaces at line rate. When specific traffic patterns intersect with additional environmental conditions outside the attacker's direct control, the bridge fails to resume normal operation and enters a lockup. The affected appliance then stops forwarding traffic on impacted interfaces, resulting in a loss of availability for the services hosted on the device. Because the flaw is triggered over the network with no authentication or user interaction required, exposure is high for any BIG-IP appliance handling untrusted or Internet-facing traffic.

Root Cause

The underlying weakness is classified as [CWE-667] Improper Locking within the High-Speed Bridge hardware and its supporting software. F5 has not publicly disclosed the exact traffic pattern that triggers the lockup in order to reduce the risk of targeted exploitation. Availability of the traffic plane is the primary impact; confidentiality and integrity of processed data are not directly affected.

Attack Vector

An unauthenticated attacker sends crafted network traffic to a BIG-IP appliance with an HSB. If the required secondary conditions are met on the target, the HSB locks up and stops forwarding packets. Because success depends on conditions beyond the attacker's control, exploitation is not deterministic, which is reflected in the high attack complexity of the CVSS 4.0 vector. No public proof-of-concept is available at the time of writing, and the vulnerability is not listed in the CISA KEV catalog. Refer to F5 security article K000151658 for vendor-published technical details.

Detection Methods for CVE-2025-58153

Indicators of Compromise

HSB-related error messages or lockup events recorded in /var/log/ltm or platform log files on BIG-IP appliances
Sudden loss of traffic forwarding on data-plane interfaces while the management plane remains reachable
Repeated hardware watchdog resets or HSB reset events reported by the platform health subsystem

Detection Strategies

Monitor BIG-IP platform health telemetry (tmsh show sys hardware, HSB counters, and interface statistics) for stalled counters or bridge reset events
Correlate spikes in unusual traffic patterns from external sources with subsequent interface or module degradation on the appliance
Forward BIG-IP syslog and SNMP traps to a centralized SIEM or data lake to build alerts on HSB lockup signatures and interface flaps

Monitoring Recommendations

Enable and retain verbose logging from the Traffic Management Microkernel (TMM) and platform daemons responsible for HSB health
Configure availability monitors and synthetic traffic checks against services fronted by BIG-IP to identify data-plane outages quickly
Track vendor advisories on my.f5.com for updated indicators and fixed release information

How to Mitigate CVE-2025-58153

Immediate Actions Required

Identify all BIG-IP hardware appliances with a High-Speed Bridge component and inventory their running software versions
Apply the fixed software release identified in F5 security article K000151658 as soon as it is available for your platform
Restrict data-plane and management-plane exposure to trusted networks where operationally feasible

Patch Information

F5 has published remediation guidance in security article K000151658. Administrators should consult the article to identify fixed BIG-IP releases for their specific hardware platform and upgrade affected devices. Software versions that have reached End of Technical Support are not evaluated by F5 and should be migrated to a supported release.

Workarounds

Deploy upstream rate limiting, DDoS scrubbing, or ACLs to reduce exposure of BIG-IP data-plane interfaces to untrusted sources
Use redundant BIG-IP pairs with failover configured so that an HSB lockup on one unit does not cause a full service outage
Follow F5 platform hardening guidance and disable unused listeners or virtual servers to shrink the attack surface until patches are applied

bash

# Example: verify BIG-IP software version and hardware platform before applying vendor patches
tmsh show sys version
tmsh show sys hardware | grep -i -E "platform|hsb"