BIG-IP Advanced WAF CVE-2025-58474

Exploitation requires a specific feature to be enabled: either BIG-IP Advanced WAF (ASM) configured on a virtual server with Server-Side Request Forgery (SSRF) protection, OR an NGINX server configured with App Protect Bot Defense. Deployments without these inspection features enabled are not affected. The vector is remote and unauthenticated (PR:N/UI:N), but the dependence on these non-default protection modules is the primary limiting factor; impact is limited to availability (service disruption of new client requests), with no confidentiality or integrity effect. F5 additionally notes that End-of-Technical-Support software versions were not evaluated, so exposure of unsupported builds is unverified.

This is a denial-of-service issue, not a code-execution or data-exposure flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated trigger, but impact is confined to availability only (VA:L and subsequent-system SA:L; VC:N/VI:N), consistent with CWE-770 (resource allocation without limits/throttling) and the Denial Of Service tag. The vendor base score of 6.9 is driven almost entirely by easy remote reachability rather than by impact severity. EPSS is low at 0.39% (31st percentile), the CVE is NOT on CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis. The signals are therefore internally consistent - easy to reach but limited blast radius - and point to a moderate, patch-in-normal-cycle priority rather than an emergency. Two caveats defenders should verify: exploitation is gated on specific non-default features being enabled (SSRF protection on a BIG-IP virtual server, or NGINX App Protect Bot Defense), which the PR:N/AT:N metrics do not capture, and End-of-Technical-Support software versions were explicitly not evaluated by F5, so unsupported deployments carry unquantified residual risk.

A remote, unauthenticated attacker sends a stream of specially crafted ('undisclosed') requests to a BIG-IP Advanced WAF virtual server that has SSRF protection enabled, or to an NGINX instance running App Protect Bot Defense. The malformed traffic exhausts or ties up a resource in the inspection path, so the device stops accepting or processing new legitimate client requests, causing a service outage. No public exploit code or active exploitation has been identified for this issue.