F5 BIG-IP CVE-2025-59268

Exploitation requires network reachability to the BIG-IP Configuration utility (the TMUI/management interface); the undisclosed endpoints are accessible to an unauthenticated remote attacker (PR:N), so no credentials or user interaction are needed against a reachable management plane. The primary limiting factor is management-interface exposure: organizations following F5's hardening guidance restrict the Configuration utility to a dedicated/isolated management network, which removes general network reachability. Impact is further limited because the disclosed endpoints return only static, non-sensitive information per the vendor, and End of Technical Support software versions were not evaluated.

This is a genuinely low-priority issue despite a 6.9 CVSS 4.0 base score. The vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) describes a network-reachable, low-complexity, unauthenticated flaw with only LOW confidentiality impact and NO integrity or availability impact - CWE-201 (information exposure) consistent with 'static non-sensitive information.' F5's own description explicitly states the exposed endpoints contain static, non-sensitive data, which undercuts the apparent severity; the real-world consequence is minor information disclosure, not credential or configuration theft. EPSS reinforces this: 0.40% probability at the 33rd percentile indicates low near-term exploitation likelihood. This CVE is NOT in CISA KEV (no active exploitation), and no public exploit code is referenced. Signals are consistent rather than conflicting - the only tension is the moderate CVSS score versus the vendor's 'non-sensitive' characterization, which argues for treating this as a low operational priority. The 6.9 is driven by the easy AV:N/AC:L/PR:N/UI:N exposure metrics rather than by impact.

An unauthenticated remote attacker who can reach the BIG-IP Configuration utility (management interface) sends HTTP requests to undisclosed endpoints and retrieves static, non-sensitive information without credentials. Given AC:L and PR:N this requires no special skill or access beyond network reachability to the management UI, but the disclosed data is explicitly non-sensitive, limiting practical value to reconnaissance. No public proof-of-concept is identified at time of analysis.