F5 BIG-IP CVE-2025-59269

Exploitation requires an authenticated, high-privilege account (PR:H) on the BIG-IP Configuration (management) utility to store the XSS payload, plus passive user interaction (UI:P) - a victim user must subsequently load the affected (undisclosed) page for the stored JavaScript to execute in their session. Limiting factors: the management interface should not be internet-exposed per F5 hardening guidance, the attacker must already hold privileged management access, and a second user must view the poisoned page; impact is scoped to actions/data available to the logged-in victim user. Software versions that have reached End of Technical Support were not evaluated, so exposure depends on the specific running version per F5 K000151308.

This is a stored XSS (CWE-79) in the F5 BIG-IP Configuration utility carrying a vendor-assigned CVSS 4.0 base score of 8.4 (High). The signals point to a moderate, not urgent, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N) shows network reach and low complexity but requires high privileges (PR:H) to inject the payload and passive victim interaction (UI:P) to trigger it - meaning the attacker must already hold a privileged administrative account on the management plane, which substantially gates exploitation. EPSS is low at 0.28% (19th percentile), consistent with a privilege-gated, interaction-dependent flaw rather than a mass-exploited internet-facing bug. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed to be under active exploitation. The headline 8.4 score is driven largely by the VC:H/VI:H impact rating (JavaScript executing in the logged-in admin's session on a security appliance), but the PR:H precondition means the real-world risk is lower than the raw number suggests - the primary concern is privilege escalation/lateral movement within a shared administrative team or abuse of a lower-privileged operator against a higher one. The CPE/tag list is very broad (nearly all BIG-IP modules), suggesting the vulnerable code is in the shared Configuration utility common to the platform; verify the exact affected/fixed versions against F5 advisory K000151308, since EoTS versions were explicitly not evaluated.

A BIG-IP administrator with high privileges stores a malicious JavaScript payload in an undisclosed field of the Configuration utility. When another logged-in user (e.g., a higher-privileged administrator) later views the affected page, the script executes in their authenticated browser session, allowing session abuse or actions performed as that user. No public exploit code is identified at time of analysis, and the attacker must already be authenticated to the management interface.