F5 BIG-IP CVE-2025-58424

Exploitation requires that the targeted BIG-IP traffic use a protocol WITHOUT message integrity protection, and that the attacker be able to deliver 'undisclosed' crafted traffic into that flow - reflected in the CVSS Attack Requirements PRESENT (AT:P) metric, which gates the otherwise unauthenticated network vector. Limiting factors: impact is confined to LOW integrity (data corruption/unauthorized modification) with no confidentiality or availability loss; software versions at End of Technical Support are explicitly not evaluated; and the attacker needs a suitable position/condition to inject traffic rather than a simple single unauthenticated request. No user interaction and no authentication are required per PR:N/UI:N.

This is a moderate-severity integrity issue, not an urgent priority. The vendor-supplied CVSS 4.0 score is 6.3 (Medium) with vector AV:N/AC:L/AT:P/PR:N/UI:N and VC:N/VI:L/VA:N - meaning network-reachable, unauthenticated, low complexity, but with Attack Requirements PRESENT (AT:P) and impact limited to LOW integrity only (no confidentiality, no availability). EPSS is low at 0.25% (14th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified, so all exploitation-likelihood signals align toward low real-world risk. The signals are internally consistent: AT:P indicates the attacker needs a specific condition (e.g., the targeted protocol must lack message integrity protection and the attacker must be positioned to inject 'undisclosed traffic'), which tempers the otherwise network/unauthenticated profile. One conflict worth noting: the input Tags include 'Information Disclosure', but the CVSS vector shows VC:N (no confidentiality impact) and VI:L (integrity impact) and the description describes data corruption/unauthorized modification - so the impact is integrity, not disclosure. Treat this as a defense-in-depth patch item rather than an emergency.

An attacker positioned on the network path (or able to inject traffic into an in-flight session) sends undisclosed crafted traffic to a BIG-IP module handling a protocol that lacks message integrity protection, causing data corruption or unauthorized modification of the data in transit. No public proof-of-concept exists, and the CVSS AT:P flag indicates the attack only works under specific conditions (vulnerable protocol in use and a suitable injection/positioning opportunity), which is consistent with the low AC:L but gated exploitation.