BIG-IP APM CVE-2025-61933

Exploitation requires the attacker to lure a specific logged-out BIG-IP APM user into opening a crafted link targeting the affected (vendor-undisclosed) page - the CVSS UI:A metric confirms active user interaction is mandatory, which is the primary limiting factor. No authentication is required of the attacker (PR:N) and the vector is network-reachable (AV:N), but success depends entirely on social engineering a victim and on the attacker discovering the undisclosed vulnerable page/parameter. Impact is confined to script execution in the victim's browser session (subsequent-system SC:L/SI:L); the appliance itself is not directly compromised (VC:N/VI:N/VA:N). End-of-Technical-Support software versions were not evaluated by the vendor, so their status is unknown.

This is a genuinely medium-tier issue, not a high-priority emergency. The input provides only a CVSS 4.0 vector (base score 5.1, MEDIUM) with AV:N/AC:L/PR:N but critically UI:A, meaning user interaction is required - the victim must click or load a crafted link. The vulnerable-system impacts are all None (VC:N/VI:N/VA:N); impact appears only on the subsequent system as SC:L/SI:L (low confidentiality and integrity to the user's browser context), which is consistent with reflected XSS that runs JavaScript in the victim's session rather than compromising the appliance itself. EPSS is low at 0.20% (9th percentile), aligning with the absence of any KEV listing or published POC - there is no signal of active or imminent mass exploitation. No SSVC decision data was provided. The signals are internally consistent: low CVSS, low EPSS, no KEV, no POC, and a reflected XSS requiring user interaction against an already logged-out user all point to a low-to-moderate real-world risk. The one notable caveat is that this affects a security-sensitive VPN/access-gateway appliance (BIG-IP APM), which raises the value of a successful phish beyond what the raw score suggests, but exploitation still depends on tricking a user.

An attacker crafts a malicious link to an undisclosed BIG-IP APM page containing a reflected XSS payload and delivers it to a target via phishing. When the logged-out user opens the link, attacker-controlled JavaScript executes in the context of the BIG-IP APM page in their browser, potentially facilitating credential harvesting on the login/logout flow. No public exploit code was identified at time of analysis.