Detect F5 BIG-IP Stack-Based Buffer Overflow Exploitation (CVE-2025-53521) in IBM QRadar
Detects exploitation attempts and post-exploitation activity related to CVE-2025-53521, a stack-based buffer overflow vulnerability (CWE-121) in F5 BIG-IP. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and may allow remote attackers to execute arbitrary code or cause denial of service by sending crafted requests that overflow stack buffers in BIG-IP processing components.
MITRE ATT&CK
QRadar Detection Query
SELECT
LOGSOURCENAME(logsourceid) AS log_source,
sourceip,
destinationip,
destinationport,
eventdirection,
QIDNAME(qid) AS event_name,
UTF8(payload) AS raw_payload,
starttime,
magnitude
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) ILIKE '%F5%'
OR LOGSOURCETYPENAME(devicetype) ILIKE '%BIG-IP%'
OR (UTF8(payload) ILIKE '%buffer overflow%'
OR UTF8(payload) ILIKE '%stack overflow%'
OR UTF8(payload) ILIKE '%segmentation fault%'
OR UTF8(payload) ILIKE '%tmm crash%'
OR UTF8(payload) ILIKE '%mcpd crash%'
OR UTF8(payload) ILIKE '%CVE-2025-53521%'
OR UTF8(payload) ILIKE '%K000156741%')
AND LOGSOURCETYPENAME(devicetype) ILIKE '%F5%'
AND starttime > NOW() - 86400000
ORDER BY magnitude DESC, starttime DESC
LIMIT 500QRadar AQL query searching F5 log sources for buffer overflow indicators, crash signals, and CVE reference strings within the past 24 hours, ordered by event magnitude.
Data Sources
Required Tables
False Positives & Tuning
- Security information in legitimate F5 advisory notifications forwarded through syslog
- BIG-IP health monitoring scripts referencing CVE identifiers in log messages
- Authorized vulnerability scanning tools generating overflow-related log entries
- Software update processes producing crash-like telemetry during component restarts
Other platforms for CVE-2025-53521
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Oversized HTTP POST Payload to BIG-IP Virtual Server
Expected signal: Network flow logs showing source IP sending >65535 bytes to BIG-IP destination port. BIG-IP LTM logs showing oversized request from test source IP. Possible 400 Bad Request or connection reset depending on BIG-IP version.
- Test 2BIG-IP iControl REST Reconnaissance Prior to Exploitation
Expected signal: BIG-IP iControl REST access logs in `/var/log/restjavad.0.log` showing authenticated GET requests from test source IP. Network logs showing HTTPS connections to BIG-IP management IP on port 443.
- Test 3Simulate BIG-IP TMM Crash and Core Dump Generation
Expected signal: Syslog messages from BIG-IP host containing 'tmm' process restart events, critical severity entries, and potential core dump references in `/var/core/`. F5 SNMP traps if configured.
Unlock Pro Content
Get the full detection package for CVE-2025-53521 including response playbook, investigation guide, and atomic red team tests.