CVE-2025-54854: BigIP APM Vulnerability
When a BIG-IP APM OAuth access profile (Resource Server or Resource Client) is configured on a virtual server, undisclosed traffic can cause the apmd process to terminate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.1.317.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.1.6.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.1.10.8
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54854?
The severity of CVE-2025-54854 is currently classified as high due to the potential for the apmd process to terminate unexpectedly.
How do I fix CVE-2025-54854?
To fix CVE-2025-54854, upgrade to the recommended versions of BIG-IP APM as specified in the vendor's advisory.
Which versions of F5 BIG-IP APM are affected by CVE-2025-54854?
The affected versions of F5 BIG-IP APM include versions between 17.1.0 and 17.1.2, 17.5.0 and 17.5.1, and 16.1.0 and 16.1.6.
What impact does CVE-2025-54854 have on BIG-IP APM?
CVE-2025-54854 can cause the apmd process to terminate, potentially leading to service disruption.
Is there a specific patch version for CVE-2025-54854?
Yes, the specific patch versions for CVE-2025-54854 are 17.5.1.317.1.3, 16.1.6.1, and 15.1.10.8.