F5 BIG-IP CVE-2025-58153

Exploitation requires an affected F5 BIG-IP HARDWARE platform that contains a High-Speed Bridge (HSB) component - software-only/virtual editions and End-of-Technical-Support versions are out of scope. The HSB lockup only occurs under 'undisclosed traffic conditions' combined with 'conditions beyond the attacker's control,' meaning the trigger is non-deterministic and cannot be reliably forced on demand; this is the primary limiting factor. No authentication and no user interaction are required (PR:N/UI:N), but the high attack complexity (AC:H) reflects the race/timing-dependent, uncontrollable nature of the trigger. Impact is limited to availability (device/HSB lockup); there is no confidentiality or integrity exposure.

This is a denial-of-service (availability) flaw, not the information-disclosure issue implied by the input tag. The CVSS 4.0 vector (AV:N/AC:H/PR:N/UI:N) confirms a network-reachable, unauthenticated condition with HIGH attack complexity and no confidentiality or integrity impact (VC:N/VI:N) but HIGH availability impact (VA:H) plus a low subsequent-system availability effect (SA:L) - consistent with CWE-667 (improper locking) causing a High-Speed Bridge (HSB) lockup. Signals are mutually consistent toward a DoS of F5 BIG-IP hardware rather than a priority RCE: EPSS is low (0.23%, 13th percentile), the vulnerability is NOT in CISA KEV, and no public POC is identified. The 8.2 (High) score is driven by network reachability and no-auth, but the AC:H rating and the description's own language ('undisclosed traffic conditions along with conditions beyond the attacker's control') strongly limit practical, reliable exploitation. Net: genuinely patch-worthy for hardware BIG-IP operators because of availability impact, but it is a high-CVSS / low-immediate-real-risk item absent evidence of a reproducible trigger - exploitation appears non-deterministic rather than attacker-controlled.

A remote, unauthenticated attacker (or ambient network traffic) sends traffic that, combined with specific uncontrollable timing/traffic conditions, triggers a locking defect in the High-Speed Bridge of an F5 BIG-IP hardware appliance, causing the HSB to lock up and the device to stop passing traffic. No public exploit code exists, and the high attack complexity plus the vendor's note about 'conditions beyond the attacker's control' mean reliable, on-demand triggering is unlikely.