CVE Feed

    Dashboard / CVE / CVE-2025-23413

    CVE-2025-23413

    When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Published:Feb 5, 2025
    Last Modified:Nov 12, 2025
    EPS:Feb 5, 2025
    EPSS Score:0.00057
    CVSS Score:4.4

    Affected Products

    Vendor
    F5
    Product
    Big-ip Next Central Manager

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-215 Fuzzing for application mapping

    Related CVEs

    CVE-2025-54500 (CVSS 6.9) — An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in or…
    CVE-2025-36504 (CVSS 8.7) — When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an …
    CVE-2025-41399 (CVSS 8.7) — When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requ…
    CVE-2025-24319 (CVSS 7.1) — When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can c…
    CVE-2024-37028 (CVSS 6.3) — BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.  Note:…
    CVE-2024-39809 (CVSS 8.9) — The Central Manager user session refresh token does not expire when a user logs out.  Note: Software versions …
    CVE-2024-41719 (CVSS 5.1) — When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credenti…
    CVE-2024-26026 (CVSS 7.5) — An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions w…
    CVE-2024-21793 (CVSS 7.5) — An OData injection vulnerability exists in the BIG-IP Next Central Manager API (URI).  Note: Software versions…
    CVE-2024-33612 (CVSS 6.8) — An improper certificate validation vulnerability exists in BIG-IP Next Central Manager and may allow an attack…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High