CVE-2025-58474
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
When BIG-IP Advanced WAF is configured with SSRF protection or NGINX with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
Risk Assessment
This could lead to denial of service for new clients.
Recommendation
Update BIG-IP Advanced WAF or NGINX App Protect Bot Defense to a patched version.
Other vulnerabilities in BIG-IP Advanced WAF
See all- CVE-2025-61935High
When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-61938High
When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters for Data Guard Protection Enforcement, either manually or via Policy Builder, the bd process can terminate repeatedly. Note: EoTS versions not evaluated.
Original NVD description (English source)
When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS