CVE-2025-61935
📋 TL;DR
This vulnerability allows attackers to cause denial of service by sending specific requests to BIG-IP Advanced WAF or ASM security policies, terminating the bd process. It affects F5 BIG-IP systems with these modules configured. Only supported software versions are affected, not end-of-support versions.
💻 Affected Systems
- F5 BIG-IP Advanced WAF
- F5 BIG-IP ASM
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption for affected virtual servers, requiring manual intervention to restore functionality.
Likely Case
Intermittent service outages affecting web application availability until the bd process is restarted.
If Mitigated
Minimal impact with proper network segmentation and request filtering in place.
🎯 Exploit Status
The vulnerability can be triggered by sending undisclosed requests, suggesting relatively simple exploitation once the specific request pattern is discovered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000154664 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000154664
Restart Required: Yes
Instructions:
1. Review F5 advisory K000154664 for applicable fixed versions. 2. Download and install the appropriate patch from F5 Downloads. 3. Restart affected services or the entire BIG-IP system as required.
🔧 Temporary Workarounds
Temporary request filtering
allImplement request filtering rules to block suspicious patterns that might trigger the vulnerability
Configure via F5 TMSH or GUI: modify security policy to add blocking rules for anomalous requests
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to affected virtual servers
- Deploy additional DoS protection mechanisms in front of BIG-IP systems
🔍 How to Verify
Check if Vulnerable:
Check if you have Advanced WAF or ASM security policies configured on virtual servers and verify your BIG-IP version against the F5 advisory.Check Version:
tmsh show sys versionVerify Fix Applied:
After patching, verify the installed version matches or exceeds the fixed version listed in the F5 advisory.📡 Detection & Monitoring
Log Indicators:
- bd process termination events in /var/log/ltm
- Unexpected service restarts in system logs
- Increased error rates in application logs
Network Indicators:
- Sudden drops in traffic to specific virtual servers
- Unusual request patterns targeting WAF/ASM endpoints
SIEM Query:
source="bigip_logs" AND ("bd terminated" OR "process crash" OR "segmentation fault")