F5 BIG-IP CVE-2025-53474

Exploitation requires a specific, non-default configuration: an iRule that uses the ILX::call command must be configured on a BIG-IP virtual server. Devices without any ILX::call-based iRule are not exploitable regardless of exposure. Where that configuration exists, the attack is remote and unauthenticated with no user interaction required (AV:N/PR:N/UI:N), triggered by 'undisclosed' network traffic to the virtual server. Impact is limited to denial of service (TMM termination); there is no confidentiality or integrity impact. Note that vendor states End of Technical Support versions were not evaluated, so exposure on EoTS releases is unverified.

This is a genuine availability risk but narrower than the 8.7 CVSS 4.0 score suggests in isolation. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity reachability, and the impact is purely availability (VA:H; VC:N/VI:N) - a Traffic Management Microkernel (TMM) crash, i.e. denial of service, not code execution or data exposure despite the CWE-120 buffer-overflow classification. The signals are consistent but modest for real-world urgency: EPSS is low at 0.35% (26th percentile), the vulnerability is NOT in CISA KEV, and no public POC is referenced, so exploitation is neither confirmed nor demonstrated. Crucially, the raw vector understates one real limiting factor: exploitation requires that an iRule using the ILX::call command be configured on a virtual server - a non-default condition the CVSS AC:L metric does not capture. Net: a legitimate patch-worthy DoS for environments that actually use ILX::call iRules, but not a drop-everything, mass-exploitation priority. No conflicting data, but note the gap between the network-exploitable vector and the required specific configuration - defenders should confirm whether ILX::call iRules are in use.

A remote, unauthenticated attacker sends specially crafted (undisclosed) traffic to a BIG-IP virtual server that has an iRule using the ILX::call command configured. The traffic triggers a buffer overflow condition that causes TMM to terminate, dropping all traffic the device processes until it restarts, producing a denial of service. No public exploit code has been identified at time of analysis, and the attack requires no authentication or user interaction (AV:N/AC:L/PR:N/UI:N) but does require the vulnerable ILX::call configuration to be present.