CVE-2025-59483: F5 BIG-IP APM Information Disclosure Flaw

CVE-2025-59483 Overview

CVE-2025-59483 is a validation vulnerability in an undisclosed URL within the F5 BIG-IP Configuration utility. The flaw affects a broad range of BIG-IP modules and requires network access with high privileges to exploit. F5 has not evaluated software versions that have reached End of Technical Support (EoTS). The vulnerability maps to [CWE-73: External Control of File Name or Path], indicating an authenticated attacker with administrative access may manipulate file references processed by the Configuration utility. Successful exploitation impacts confidentiality and integrity of the affected BIG-IP system.

Critical Impact
An authenticated high-privilege attacker with network access to the BIG-IP Configuration utility can compromise confidentiality and integrity across affected BIG-IP modules.

Affected Products

F5 BIG-IP Access Policy Manager (APM), Advanced Firewall Manager (AFM), Advanced Web Application Firewall (AWAF)
F5 BIG-IP Application Security Manager (ASM), Local Traffic Manager (LTM), Global Traffic Manager (GTM), DNS, and Link Controller
F5 BIG-IP SSL Orchestrator, DDoS Hybrid Defender, Policy Enforcement Manager, WebAccelerator, WebSafe, Analytics, Automation Toolchain, Carrier-Grade NAT, Container Ingress Services, Edge Gateway, Fraud Protection Service, and Application Visibility and Reporting

Discovery Timeline

2025-10-15 - CVE-2025-59483 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59483

Vulnerability Analysis

The vulnerability resides in an undisclosed URL exposed by the BIG-IP Configuration utility, the management interface used to administer BIG-IP modules. F5 categorizes the weakness as a validation flaw, and the assigned CWE-73 indicates the Configuration utility permits external control of a file name or path. An authenticated attacker holding administrative privileges can send crafted requests to the vulnerable endpoint. The Configuration utility fails to properly validate the supplied input before using it in a file-related operation. This enables attackers to reference or manipulate files outside the intended scope, resulting in high impact to confidentiality and integrity. Availability is not affected. F5 has withheld exact endpoint details in its security bulletin to reduce the risk of exploitation prior to patching.

Root Cause

The root cause is insufficient validation of user-controlled input that is subsequently used to construct a file name or path within the Configuration utility. Because the utility trusts the supplied value, an authenticated administrator can influence which file the system reads or writes. This weakness is characteristic of [CWE-73] flaws in management interfaces that expose file-based operations through web parameters without strict allow-listing or canonicalization.

Attack Vector

Exploitation requires network access to the BIG-IP Configuration utility and authentication with high privileges. The attacker submits a crafted request to the affected URL, supplying a manipulated path or file reference. Because the Configuration utility runs with elevated system rights, the manipulated file operation can expose sensitive configuration data or alter files that influence BIG-IP behavior. Refer to the F5 Security Article K000156800 for the authoritative vendor description and affected version matrix. No public proof-of-concept or in-the-wild exploitation has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-59483

Indicators of Compromise

Unexpected authenticated sessions to the BIG-IP Configuration utility from unusual source IPs or outside standard administrative hours.
Configuration utility audit log entries referencing file paths that traverse directories (for example, ..) or point to sensitive system files.
Newly created or modified administrative accounts on BIG-IP followed by activity against management URLs.

Detection Strategies

Enable and forward BIG-IP audit logs (/var/log/audit) and Configuration utility access logs to a centralized SIEM for correlation.
Alert on requests to Configuration utility endpoints containing suspicious file-path characters or references to system directories such as /etc, /config, or /var/db.
Baseline legitimate administrator behavior and flag deviations, particularly high volumes of file-related API calls from a single session.

Monitoring Recommendations

Restrict management-plane exposure and monitor network flows to TCP ports used by the Configuration utility from non-management subnets.
Track authentication events for administrative accounts and alert on privilege changes, failed logins followed by success, or logins from new geolocations.
Continuously monitor integrity of BIG-IP configuration files and compare against known-good baselines.

How to Mitigate CVE-2025-59483

Immediate Actions Required

Apply the fixed BIG-IP versions listed in F5 Security Article K000156800 as soon as maintenance windows permit.
Restrict access to the BIG-IP Configuration utility to a dedicated, isolated management network. Never expose the management interface to the internet.
Audit administrative accounts, rotate credentials, and remove unused high-privilege users.

Patch Information

F5 has published fixed software versions in F5 Security Article K000156800. Software versions that have reached End of Technical Support (EoTS) were not evaluated and should be upgraded to a supported, patched release. Administrators should review the advisory for the specific fixed versions applicable to each BIG-IP module in their environment.

Workarounds

Limit Configuration utility access using a management-network access control list (ACL) and BIG-IP httpd allow-list configuration.
Enforce multi-factor authentication for all administrative logins to the BIG-IP management plane.
Reduce administrator counts to the minimum required and use role-based access to avoid granting unnecessary high-privilege rights.

bash

# Restrict Configuration utility access to a management subnet
tmsh modify sys httpd allow replace-all-with { 10.10.0.0/24 127.0.0.1 }
tmsh save sys config

# Verify the applied allow-list
tmsh list sys httpd allow