Strix
26.1K

CVE-2025-53856

HIGHCVSS 8.7/10EPSS 0.32%

Last modified

CVE-2025-53856 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 .  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.. EPSS estimates a 0.32% chance of exploitation in the next 30 days.

Description

When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 .  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS 4.0
8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.32%

23.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
F5Big-Ip Access Policy Manager>= 15.1.0, < 15.1.10.8
F5Big-Ip Advanced Firewall Manager>= 15.1.0, < 15.1.10.8
F5Big-Ip Advanced Web Application Firewall>= 15.1.0, < 15.1.10.8
F5Big-Ip Analytics>= 15.1.0, < 15.1.10.8
F5Big-Ip Application Acceleration Manager>= 15.1.0, < 15.1.10.8
F5Big-Ip Application Security Manager>= 15.1.0, < 15.1.10.8
F5Big-Ip Application Visibility And Reporting>= 15.1.0, < 15.1.10.8
F5Big-Ip Automation Toolchain>= 15.1.0, < 15.1.10.8
F5Big-Ip Carrier-Grade Nat>= 15.1.0, < 15.1.10.8
F5Big-Ip Container Ingress Services>= 15.1.0, < 15.1.10.8
F5Big-Ip Ddos Hybrid Defender>= 15.1.0, < 15.1.10.8
F5Big-Ip Domain Name System>= 15.1.0, < 15.1.10.8
F5Big-Ip Edge Gateway>= 15.1.0, < 15.1.10.8
F5Big-Ip Fraud Protection Service>= 15.1.0, < 15.1.10.8
F5Big-Ip Global Traffic Manager>= 15.1.0, < 15.1.10.8
F5Big-Ip Link Controller>= 15.1.0, < 15.1.10.8
F5Big-Ip Local Traffic Manager>= 15.1.0, < 15.1.10.8
F5Big-Ip Policy Enforcement Manager>= 15.1.0, < 15.1.10.8
F5Big-Ip Ssl Orchestrator>= 15.1.0, < 15.1.10.8
F5Big-Ip Webaccelerator>= 15.1.0, < 15.1.10.8
F5Big-Ip Websafe>= 15.1.0, < 15.1.10.8
F5Big-Ip Access Policy Manager>= 16.1.0, < 16.1.6.1
F5Big-Ip Advanced Firewall Manager>= 16.1.0, < 16.1.6.1
F5Big-Ip Advanced Web Application Firewall>= 16.1.0, < 16.1.6.1
F5Big-Ip Analytics>= 16.1.0, < 16.1.6.1
F5Big-Ip Application Acceleration Manager>= 16.1.0, < 16.1.6.1
F5Big-Ip Application Security Manager>= 16.1.0, < 16.1.6.1
F5Big-Ip Application Visibility And Reporting>= 16.1.0, < 16.1.6.1
F5Big-Ip Automation Toolchain>= 16.1.0, < 16.1.6.1
F5Big-Ip Carrier-Grade Nat>= 16.1.0, < 16.1.6.1
F5Big-Ip Container Ingress Services>= 16.1.0, < 16.1.6.1
F5Big-Ip Ddos Hybrid Defender>= 16.1.0, < 16.1.6.1
F5Big-Ip Domain Name System>= 16.1.0, < 16.1.6.1
F5Big-Ip Edge Gateway>= 16.1.0, < 16.1.6.1
F5Big-Ip Fraud Protection Service>= 16.1.0, < 16.1.6.1
F5Big-Ip Global Traffic Manager>= 16.1.0, < 16.1.6.1
F5Big-Ip Link Controller>= 16.1.0, < 16.1.6.1
F5Big-Ip Local Traffic Manager>= 16.1.0, < 16.1.6.1
F5Big-Ip Policy Enforcement Manager>= 16.1.0, < 16.1.6.1
F5Big-Ip Ssl Orchestrator>= 16.1.0, < 16.1.6.1
F5Big-Ip Webaccelerator>= 16.1.0, < 16.1.6.1
F5Big-Ip Websafe>= 16.1.0, < 16.1.6.1
F5Big-Ip Access Policy Manager>= 17.1.0, < 17.1.3
F5Big-Ip Access Policy Manager>= 17.5.0, <= 17.5.1
F5Big-Ip Advanced Firewall Manager>= 17.1.0, < 17.1.3
F5Big-Ip Advanced Firewall Manager>= 17.5.0, <= 17.5.1
F5Big-Ip Advanced Web Application Firewall>= 17.1.0, < 17.1.3
F5Big-Ip Advanced Web Application Firewall>= 17.5.0, <= 17.5.1
F5Big-Ip Analytics>= 17.1.0, < 17.1.3
F5Big-Ip Analytics>= 17.5.0, <= 17.5.1

Showing 50 of 83 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2025-53856?
When a virtual server, network address translation (NAT) object, or secure network address translation (SNAT) object uses the embedded Packet Velocity Acceleration (ePVA) feature, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  To determine which BIG-IP platforms have an ePVA chip refer to K12837: Overview of the ePVA feature https://my.f5.com/manage/s/article/K12837 .  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
How severe is CVE-2025-53856?
CVE-2025-53856 has a CVSS score of 8.7/10 (HIGH severity). The EPSS model estimates a 0.32% probability of exploitation in the next 30 days.
How do I fix CVE-2025-53856?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-53856?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST