F5 BIG-IP CVE-2025-59483

Exploitation requires an authenticated session with HIGH privileges on the BIG-IP Configuration utility (management GUI/TMUI) per CVSS PR:H - this is not reachable by an unauthenticated attacker and is the primary limiting factor. The flaw lies in an undisclosed URL within the Configuration utility that performs insufficient validation of a user-controlled file name or path (CWE-73). No user interaction is needed (UI:N) and the attack is network-reachable (AV:N), so once high-privilege access exists it is straightforward (AC:L). Additional limiter: software versions that have reached End of Technical Support (EoTS) were not evaluated, so defenders on unsupported builds cannot assume they are unaffected. Exploitation is bounded to whatever BIG-IP modules expose the affected Configuration utility endpoint across the listed product family.

This is a genuine but access-gated priority rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N) scores 8.5 High and tells a consistent story: network-reachable, low attack complexity, no user interaction, but requiring HIGH privileges (PR:H) - meaning an already-authenticated administrative/operator account on the BIG-IP Configuration utility is a prerequisite. CWE-73 (external control of file name or path) combined with VC:H/VI:H indicates an authenticated actor can read and/or write/manipulate files or paths beyond their intended scope, yielding high confidentiality and integrity impact but no availability impact (VA:N). The signals do NOT conflict but they do temper each other: EPSS is low at 0.37% (29th percentile), there is no CISA KEV listing, and no public exploit code is referenced - so this is not currently a mass-exploitation candidate. The high CVSS is driven by impact magnitude, not by ease of untrusted access; PR:H is the key limiter. Note a tagging nuance: the input Tag set labels this 'Information Disclosure', yet the vector asserts VI:H (integrity impact), so impact may extend beyond pure disclosure - treat the integrity dimension as real. Bottom line: high-value target product, meaningful impact, but exploitation is bounded behind authenticated high-privilege access, placing this below unauthenticated-RCE-class F5 bugs in urgency.

An attacker who has obtained high-privilege credentials to the BIG-IP Configuration utility (for example a compromised admin/operator account or an insider) sends a crafted request to the affected undisclosed URL, abusing insufficient validation of a file name or path (CWE-73) to access or alter files outside the intended scope. This leverages the appliance's trusted management plane to compromise sensitive configuration or data. No public exploit code is identified at time of analysis, and exploitation requires pre-existing authenticated high-privilege access per the CVSS PR:H metric.