F5 Big Ip Next Central Manager vulnerabilities
12 vulnerabilities
Known vulnerabilities in F5 Big Ip Next Central Manager, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-54500f5big-ip+28
EPSS score0.50%
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack).
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.CVE-2025-41399f5big-ip+27EPSS score0.43%
When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.CVE-2025-36504f5big-ip+27EPSS score0.44%
When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.CVE-2025-24319f5big-ip_next_central_managerEPSS score0.39%
When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.CVE-2025-23413f5big-ip_next_central_managerEPSS score0.16%
When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.CVE-2024-21793f5big-ip_next_central_managerEPSS score7.09%
An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.CVE-2024-41719f5big-ip_next_central_managerEPSS score0.15%
When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-IP Central Manager logs. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.CVE-2024-26026f5big-ip_next_central_managerEPSS score7.16%
An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Technical Support (EoTS) are not evaluatedCVE-2024-39809f5big-ip_next_central_managerEPSS score0.44%
The Central Manager user session refresh token does not expire when a user logs out. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluatedCVE-2024-37028f5big-ip_next_central_managerEPSS score0.45%
BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.CVE-2024-32049f5big-ip_next_central_managerEPSS score0.55%
BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.CVE-2024-33612f5big-ip_next_central_managerEPSS score0.23%
An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attacker to impersonate an Instance Provider system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.