CVE-2025-53521: F5 BIG-IP APM Stack-Based Buffer Overflow -- RCE

Background

F5 BIG-IP Access Policy Manager (APM) is a widely deployed application access control and SSL VPN solution that provides identity-aware access to applications and APIs. It serves as a centralised access gateway for enterprise networks, handling authentication, authorisation, multi-factor authentication enforcement, and SSL offloading for applications. BIG-IP APM is extensively deployed in financial services, healthcare, government, and large enterprise environments where it controls access to critical business applications.

F5 BIG-IP products have been targeted by sophisticated threat actors — CVE-2022-1388 (iControl REST auth bypass) was one of the most rapidly exploited vulnerabilities of 2022, and CVE-2023-46747 (auth bypass with RCE) saw nation-state exploitation. The centralised access gateway role of BIG-IP APM makes it a high-value target: compromise grants an attacker the ability to intercept authentication material, bypass access controls, or establish persistent VPN access. CISA added CVE-2025-53521 to the KEV catalogue on 2026-03-27.

Technical Mechanism

CVE-2025-53521 is a stack-based buffer overflow in the BIG-IP APM component. Stack-based buffer overflows occur when a function writes more data to a stack-allocated buffer than the buffer can hold, overwriting adjacent stack memory including saved return addresses and frame pointers.

In the BIG-IP APM context, the overflow likely occurs during the processing of user-supplied data — such as authentication credentials, HTTP headers, or SAML/OAuth tokens — in a C/C++ code path that lacks adequate bounds checking:

1. An attacker crafts a request containing an oversized value in a field processed by the vulnerable APM code
2. The value is copied into a fixed-size stack buffer without length validation
3. The overflow overwrites the stack frame, including the saved return address
4. If the attacker can control the overflow content precisely enough (or bypass stack canaries/ASLR via information leaks), they redirect execution to attacker-controlled code
5. The attacker achieves code execution under the BIG-IP process context (typically root on BIG-IP appliances)

BIG-IP runs a customised Linux distribution; successful exploitation yields root access to the TMOS operating system, enabling modification of traffic policies, certificate theft, session hijacking of all proxied connections, and lateral movement to backend application servers.

Real-World Exploitation Evidence

CVE-2025-53521 was added to CISA KEV on 2026-03-27. The F5 BIG-IP exploitation ecosystem is well-established:

• Nation-state actors — Chinese APT groups (tracked under various designations) have targeted F5 BIG-IP as part of network perimeter intrusion campaigns, using it to establish persistent footholds
• Ransomware operators — F5 BIG-IP vulnerabilities have been used by ransomware initial access brokers; access to a BIG-IP APM gateway provides a foothold from which to access the internal application network
• Traffic interception — a compromised BIG-IP APM can be used to capture authentication tokens, session cookies, and credentials for all applications it proxies — a particularly valuable capability for espionage actors
• The combination of internet exposure (required for VPN/access gateway functionality) and root-level code execution makes exploitation of BIG-IP vulnerabilities uniquely impactful

Impact Assessment

CVE-2025-53521 targets the BIG-IP APM component, which by its design must be reachable from the internet to serve its VPN and access gateway role. Successful exploitation yields root access to the TMOS operating system, giving an attacker full control of the appliance. From this position the attacker can modify traffic policies to intercept authentication material for all proxied applications, extract SSL/TLS private keys and certificates, steal LDAP and Active Directory integration credentials, and establish persistent access through new admin accounts or modified configuration. The 8.8 CVSS score reflects an authentication requirement in the attack chain, though the specific conditions required for exploitation may be satisfied by low-privilege access or pre-authentication in certain configurations.

The organisational blast radius is unusually wide because BIG-IP APM sits at the network access control boundary. A compromised access gateway can silently harvest session tokens and credentials for every application behind it, without triggering alerts at the application layer. Financial services, healthcare, and government organisations — the primary BIG-IP APM user base — face exposure of their most sensitive internal application access. For ransomware actors, a BIG-IP foothold provides network-level access to internal application segments that may not be reachable any other way. For nation-state espionage actors, persistent implants on the access gateway enable long-term credential collection that is extremely difficult to detect and attribute.

Affected Versions

Consult F5 Security Advisory K-XXXXXXXX for definitive affected version ranges and patch availability by BIG-IP version branch.

Remediation Steps

1. Apply F5’s security patch or hotfix immediately — consult the F5 Security Advisory for your BIG-IP version branch
2. If patching is delayed, consider implementing a WAF rule or iRule to block oversized inputs to APM endpoints
3. Restrict management access (TMUI/admin interface) to trusted administrator IP ranges
4. Enable BIG-IP’s built-in iHealth monitoring to detect anomalous system state
5. Rotate all certificates, keys, and credentials stored on or accessible via BIG-IP APM:
   • SSL/TLS certificates and private keys
   • LDAP/Active Directory integration credentials
   • OAuth client secrets
6. Review BIG-IP audit logs for unexpected administrator logins or configuration changes
7. Check APM access policy logs for unusual authentication patterns or policy modifications
8. Monitor for unexpected outbound connections from the BIG-IP management IP
9. If compromise is suspected, engage F5 support and treat all credentials brokered by the APM as potentially compromised

Detection Guidance

BIG-IP APM logs — review /var/log/apm for:

• Authentication requests with unusually large credential fields
• APM policy denials from unexpected source IP addresses immediately followed by successful access
• Configuration change events not correlated with administrator activity

BIG-IP system logs — /var/log/ltm, /var/log/secure:

• Process crashes or restarts of APM-related daemons
• Unexpected root-level process execution

SIEM query example (Splunk):

index=f5_logs sourcetype=bigip_apm
| search event_type="APM_POLICY_AGENT_EVENT"
| eval field_len=len(credential_field)
| where field_len > 4096
| stats count by src_ip, virtual_server, field_len
| sort -field_len

Network indicators:

• Connection attempts with oversized HTTP headers or body fields to the BIG-IP virtual server
• Unexpected outbound connections from the BIG-IP management address to external IP addresses

Timeline

References

• NVD — CVE-2025-53521
• CISA KEV — CVE-2025-53521
• F5 Security Advisory — CVE-2025-53521