Cyber Posture

CVE-2025-24320

High

Published: 05 February 2025

Published
05 February 2025
Modified
21 October 2025
KEV Added
—
Patch
—
CVSS Score 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0085 75.0th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse various implementations of JavaScript for execution.

Security Summary

CVE-2025-24320 is a stored cross-site scripting (XSS) vulnerability, associated with CWE-79, affecting an undisclosed page in the F5 BIG-IP Configuration utility. The issue arises from an incomplete fix for the prior vulnerability CVE-2024-31156 and enables an attacker to execute JavaScript in the context of the currently logged-in user. It carries a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Software versions that have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.

Exploitation requires an attacker to have low-privilege (PR:L) authenticated access to the BIG-IP Configuration utility over the network (AV:N). By injecting a malicious payload onto the vulnerable page, the attacker can trigger JavaScript execution when another logged-in user accesses and interacts with the page (UI:R/AC:L). Successful exploitation allows high-impact outcomes, including unauthorized access to confidential data (C:H), modification of system integrity (I:H), and disruption of availability (A:H), such as stealing session cookies or performing actions on behalf of the victim user.

The F5 security advisory at https://my.f5.com/manage/s/article/K000140578 provides details on mitigation, including available patches and any recommended workarounds.

Details

CWE(s)
CWE-79

Affected Products

f5
big-ip access policy manager
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2
f5
big-ip advanced firewall manager
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2
f5
big-ip advanced web application firewall
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2
f5
big-ip analytics
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2
f5
big-ip application acceleration manager
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2
f5
big-ip application security manager
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2
f5
big-ip application visibility and reporting
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2
f5
big-ip automation toolchain
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2
f5
big-ip carrier-grade nat
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2
f5
big-ip container ingress services
15.1.0 — 15.1.10.6 · 16.1.0 — 16.1.5.2 · 17.1.0 — 17.1.2
+11 more product configuration(s) — see NVD for full list

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
Why these techniques?

Stored XSS in network-accessible web config utility directly enables exploitation of public-facing applications (T1190) and arbitrary JavaScript execution in victim browser context (T1059.007).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References