PT-2025-5741 · F5 · Big-Ip Configuration Utility

Published 2025-02-05 · Updated 2025-10-21 · CVE-2025-24320

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: BIG-IP Configuration utility (affected versions not specified)

Description: A stored cross-site scripting (XSS) issue exists in an undisclosed page of the BIG-IP Configuration utility, allowing an attacker to run JavaScript in the context of the currently logged-in user. This issue is due to an incomplete fix. The estimated number of potentially affected devices worldwide is not available. Details about real-world incidents where this issue was exploited are not provided.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-05340

CVE-2025-24320

Affected Products

Big-Ip Configuration Utility

References · 9

• https://my.f5.com/manage/s/article/K000140578 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05340 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-24320 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24320 · Vendor Advisory
• https://twitter.com/BursaMatus/status/1887217380700324057 · Twitter Post
• https://t.me/cvedetector/17324 · Telegram Post
• https://t.me/cveNotify/139685 · Telegram Post
• https://twitter.com/CVEnew/status/1887197094861037777 · Twitter Post
• https://twitter.com/BursaMatus/status/1887252712934256785 · Twitter Post