F5 BIG-IP ASM CVE-2025-61935
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach virtual server with WAF/ASM policy
-
DeliverySend crafted undisclosed request
-
ExploitTrigger unchecked return in bd
-
Executionbd process terminates
-
ImpactDenial of service on protected traffic
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Return value checking
|
| Exploitation Conditions | Exploitation requires that a BIG-IP Advanced WAF or ASM security policy be configured and bound to a virtual server - this is the exact prerequisite stated in the advisory; appliances without a WAF/ASM policy applied to the targeted virtual server are not affected. Within that configuration, no authentication or user interaction is needed (PR:N/UI:N) and the request is network-reachable (AV:N) with low complexity (AC:L). Additional limiting factors: software versions past End of Technical Support were not evaluated, so affected-version certainty is bounded to supported releases (CPE confirms 17.5.0 among affected branches). |
| Impact | This is a denial-of-service vulnerability (CWE-252, Unchecked Return Value) in F5 BIG-IP Advanced WAF/ASM where undisclosed requests crash the bd (bot defense / traffic management enforcement) process. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with availability-only impact (VA:H; VC:N/VI:N), consistent with a crash rather than code execution or data exposure. Despite the high 8.7 score, exploitation probability signals are modest: EPSS is only 0.35% (26th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is identified. This is the classic high-CVSS-but-currently-low-real-world-exploitation profile - the severity is driven by easy, unauthenticated, remote reachability against a security appliance, but there is no evidence of active or widespread exploitation. A key limiting factor contradicts raw score fear: exploitation is only possible when a WAF/ASM security policy is actually bound to a virtual server, so the attack surface is narrower than AV:N/PR:N alone suggests. The vendor advisory tag 'Information Disclosure' conflicts with the CVSS vector (VC:N, VA:H) - this is an availability/DoS issue, not information disclosure; treat the tag as mislabeled. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends specially crafted HTTP requests to a virtual server that has a BIG-IP Advanced WAF or ASM security policy attached. The malformed input triggers the unchecked-return-value flaw and terminates the bd process, disrupting traffic inspection and causing a denial of service. No public exploit code is currently identified, and the attack is only viable where a WAF/ASM policy is bound to the targeted virtual server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A remote, unauthenticated denial-of-service condition affects F5 BIG-IP Advanced WAF and Application Security Manager (ASM) when a security policy is configured and bound to a virtual server: a specially crafted, undisclosed request causes the bd process to terminate, disrupting the traffic-handling and enforcement functions associated with that policy. Exploitation requires only that a WAF/ASM policy be attached to the targeted virtual server (PR:N/UI:N, AV:N, AC:L) - virtual servers without an attached policy are not affected - and the resulting impact is limited to availability (C:N/I:N/A:H, assessed CVSS:3.1 base 7.5-equivalent for the DoS component; vendor scores 8.7 under CVSS 4.0). No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is 0.35% (26th percentile), indicating low near-term exploitation likelihood.
RemediationAI
Patch status is not confirmed within the provided data - the authoritative list of fixed releases is maintained in F5 advisory K000154664 (https://my.f5.com/manage/s/article/K000154664), which should be consulted and the relevant BIG-IP/Advanced WAF/ASM release applied as soon as F5 publishes a fixed version for the supported branch; note that End-of-Technical-Support releases are not evaluated and will not receive fixes. Until an upgrade can be performed, the most effective compensating control is to reduce the exposed attack surface: remove the Advanced WAF/ASM security policy binding from internet-facing virtual servers that do not strictly require it, accepting the loss of application-layer protection and of the associated logging/blocking capability for those virtual servers as a trade-off. Where the policy must remain enabled, restrict reachability of the affected virtual server to trusted source networks via network ACLs, firewall rules, or BIG-IP packet filters - this does not eliminate the defect but sharply limits who can trigger it, at the cost of blocking legitimate external users if scoped too narrowly. Because the failure terminates the bd process, ensure process-supervision/monitoring (and, where supported, automatic service restart via bigd/syslog alerting) is in place so that enforcement resumes quickly and repeated crash events are detected and logged; monitor F5 iHealth and the advisory article for an updated fixed-version list, and open a support case if the deployment is internet-facing and cannot be patched or restricted.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-252 (Unchecked Return Value): a routine inside the BIG-IP WAF/ASM enforcement path fails to validate the return value of an operation on attacker-influenced input, so a request that produces an unexpected return state is not handled gracefully and the bd process exits. bd is the daemon F5 uses for traffic-management/bot-defense enforcement on virtual servers; its termination interrupts the WAF/ASM inspection and enforcement pipeline for the virtual server to which the policy is bound, producing a denial-of-service condition rather than any confidentiality or integrity loss (the assessed vector scores VC:N, VI:N, VA:H). The affected code path is only reachable when an Advanced WAF or ASM security policy is provisioned and attached to a virtual server, per CPE data covering cpe:2.3:a:f5:big-ip_advanced_web_application_firewall and cpe:2.3:a:f5:big-ip_application_security_manager, including version branch 17.5.0. Note that the source metadata carries an 'Information Disclosure' tag, which is inconsistent with the advisory text and the independent assessment; the demonstrated impact is availability-only, and that tag should not be treated as evidence of data exposure. Versions that have reached End of Technical Support were explicitly not evaluated, so the affected-version boundary is limited to still-supported releases.
Know when Big Ip Advanced Web Application Firewall gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated crafted requests crash the bd process (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H) with no confidentiality or integrity effect and no scope change.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
DescriptionCVE.org
When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
A high-severity availability flaw in F5 BIG-IP Advanced WAF and Application Security Manager (ASM) allows any remote, unauthenticated party to crash the bd process by sending a crafted request to any virtual server that has a security policy bound to it, temporarily disabling web application firewall inspection for that service. Organizations running BIG-IP with active WAF/ASM enforcement on internet-facing applications are exposed today with no vendor patch available, meaning the protection layer they rely on for regulatory and application security obligations can be knocked offline on demand. Leadership should care because this is a targeted outage of a security control rather than a data breach - but it degrades defense-in-depth and can be repeated at will against critical public services.
No vendor-released patch identified at time of analysis. Interim mitigations: unbind Advanced WAF/ASM security policies from virtual servers where enforcement is not required, since virtual servers without an attached policy are not affected; monitor bd process health and WAF enforcement state to detect and respond to repeated terminations; restrict or filter network access to policy-bound virtual servers at the perimeter where operationally feasible; apply any configuration-level mitigation or iRule published in the F5 advisory and track F5 Support for hotfix availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious tra
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authe
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BI
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdow
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x
GitHub PoC
Exploit-DB