CVE-2025-55036
📋 TL;DR
A memory corruption vulnerability in BIG-IP SSL Orchestrator's explicit forward proxy when proxy connect is enabled allows attackers to potentially execute arbitrary code or cause denial of service. This affects F5 BIG-IP SSL Orchestrator users with specific configurations. Only supported software versions are affected - end-of-support versions are not evaluated.
💻 Affected Systems
- F5 BIG-IP SSL Orchestrator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or persistent backdoor installation.
Likely Case
Denial of service causing service disruption or system crashes affecting SSL traffic processing.
If Mitigated
Limited impact with proper network segmentation and exploit prevention controls in place.
🎯 Exploit Status
Exploitation requires sending specific undisclosed traffic patterns to vulnerable configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check K000151368 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000151368
Restart Required: Yes
Instructions:
1. Review K000151368 advisory 2. Identify affected systems 3. Download and apply appropriate patch 4. Restart affected services 5. Verify patch application
🔧 Temporary Workarounds
Disable Proxy Connect Feature
allTemporarily disable the proxy connect feature on SSL Orchestrator explicit forward proxy configurations
tmsh modify ltm virtual <virtual_server_name> profiles remove { <proxy_connect_profile> }
Remove Explicit Forward Proxy Configuration
allRemove explicit forward proxy configuration from vulnerable virtual servers
tmsh modify ltm virtual <virtual_server_name> profiles remove { <explicit_forward_proxy_profile> }
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to SSL Orchestrator instances
- Deploy intrusion prevention systems with memory corruption protection rules
🔍 How to Verify
Check if Vulnerable:
Check if SSL Orchestrator has explicit forward proxy configured with proxy connect enabled using: tmsh list ltm virtual <name> field-fmtCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify patch version matches fixed versions in K000151368 and proxy connect is either disabled or patched📡 Detection & Monitoring
Log Indicators:
- Memory allocation errors in /var/log/ltm
- Unexpected process crashes
- High memory usage spikes
Network Indicators:
- Abnormal SSL/TLS connection patterns
- Traffic spikes to proxy ports
- Connection attempts with malformed proxy requests
SIEM Query:
source="f5_bigip" AND ("memory corruption" OR "segmentation fault" OR "proxy connect")