BIG-IP Advanced WAF CVE-2025-54858

Exploitation requires a specific non-default configuration: a BIG-IP Advanced WAF/ASM Security Policy must have a JSON content profile whose JSON schema is MALFORMED, and that security policy must be applied to a virtual server receiving traffic. Only then can undisclosed remote requests crash the bd process. The key limiting factor is this erroneous/malformed JSON schema configuration - correctly configured JSON content profiles, policies without JSON profiles, or unbound policies are not affected; End of Technical Support software versions were not evaluated. No authentication or user interaction is needed by the attacker once the vulnerable configuration exists (CVSS PR:N/UI:N).

This is a denial-of-service vulnerability (CVSS 4.0 vector shows VA:H with VC:N/VI:N - availability-only impact, no confidentiality or integrity loss) in F5 BIG-IP Advanced WAF/ASM, scored 8.7 by the vendor (f5sirt@f5.com). Signals conflict on real-world priority: the CVSS vector is network/low-complexity/no-privilege/no-UI (AV:N/AC:L/PR:N/UI:N), which looks like a trivially remotely triggerable flaw, but the description imposes a significant precondition - the WAF must be configured with a JSON content profile containing a MALFORMED JSON schema and that policy must be applied to a virtual server. This is effectively a misconfiguration-dependent crash, not a flaw in default deployments, which materially lowers the realistic exposure. EPSS is low at 0.35% (26th percentile), there is no CISA KEV listing and no public exploit identified, consistent with a DoS bug that is not being mass-exploited. Note the CVSS does not model the required malformed-schema configuration, so the AC:L/PR:N vector overstates ease of exploitation against a typical production WAF. Overall: a genuine remotely triggerable DoS worth patching on exposed BIG-IP WAF tiers, but it is not an emergency - real risk is gated by a non-default/erroneous configuration rather than a default-reachable condition.

On a BIG-IP Advanced WAF/ASM where an administrator has (likely mistakenly) defined a JSON content profile with a malformed JSON schema and bound that security policy to a virtual server, a remote attacker sends specially crafted (undisclosed) HTTP requests to that virtual server. Processing the request against the broken schema causes the bd (traffic/enforcement) process to terminate, disrupting traffic handling. No public exploit or POC is identified at time of analysis, and the attack requires the vulnerable malformed-schema configuration to already be present.