Server-Side Request Forgery Issue in F5 BIG-IP Advanced WAF Product
CVE-2025-58474

6.9MEDIUM

Key Information:

Vendor

F5
Status
Big-ip
Nginx App Protect Waf
Vendor
CVE Published:
15 October 2025

What is CVE-2025-58474?

A vulnerability exists in F5's BIG-IP Advanced WAF when configured with Server-Side Request Forgery (SSRF) protection. This issue can allow undisclosed requests to interfere with new client requests, affecting the overall functionality of services relying on this web application firewall. The problem is particularly notable when the WAF is associated with NGINX's App Protect Bot Defense feature, leading to potential disruption in request handling unless properly mitigated through updated configurations.

Affected Version(s)

BIG-IP 17.1.0 < 17.1.2

NGINX App Protect WAF 4.0.0 < 4.7.0

BIG-IP 17.5.0

References

https://my.f5.com/manage/s/article/K000148512
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5
JSON
.
CVE-2025-58474 : Server-Side Request Forgery Issue in F5 BIG-IP Advanced WAF Product