Detect F5 BIG-IP Stack-Based Buffer Overflow Exploitation (CVE-2025-53521) in Splunk
Detects exploitation attempts and post-exploitation activity related to CVE-2025-53521, a stack-based buffer overflow vulnerability (CWE-121) in F5 BIG-IP. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and may allow remote attackers to execute arbitrary code or cause denial of service by sending crafted requests that overflow stack buffers in BIG-IP processing components.
MITRE ATT&CK
SPL Detection Query
index=network OR index=f5 OR index=firewall sourcetype IN ("f5:bigip:syslog", "f5:bigip:ltm:log", "f5:bigip:apm:log", "cisco:asa", "pan:traffic")
| eval is_bigip=if(match(host, "(?i)bigip|f5|ltm|gtm|apm"), 1, 0)
| search is_bigip=1 OR vendor="F5"
| eval crash_signal=if(match(_raw, "(?i)(stack overflow|buffer overflow|segmentation fault|segfault|core dump|tmm.*crash|mcpd.*crash|stack smash|stack.*buffer|CVE-2025-53521|K000156741)"), 1, 0)
| eval large_payload=if(isnum(bytes) AND bytes > 65535, 1, 0)
| eval severity_critical=if(match(severity, "(?i)(emergency|alert|critical|emerg|crit)"), 1, 0)
| where crash_signal=1 OR (large_payload=1 AND severity_critical=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(dest_ip) as dest_ips values(severity) as severities by host
| eval risk_score=case(crash_signal=1 AND count > 5, "critical", crash_signal=1, "high", large_payload=1 AND severity_critical=1, "medium", true(), "low")
| sort - count
| table host, count, first_seen, last_seen, source_ips, dest_ips, severities, risk_scoreSearches F5 BIG-IP syslog and LTM/APM log sourcetypes for stack/buffer overflow indicators, crash signals, and oversized payloads that may indicate CVE-2025-53521 exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Load testing or performance benchmarking generating high-volume oversized requests to BIG-IP
- BIG-IP hardware failures or memory errors producing crash logs unrelated to exploitation
- Vulnerability scanners generating malformed payloads during authorized assessments
- Legitimate large file transfers through BIG-IP virtual servers triggering payload size thresholds
Other platforms for CVE-2025-53521
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Oversized HTTP POST Payload to BIG-IP Virtual Server
Expected signal: Network flow logs showing source IP sending >65535 bytes to BIG-IP destination port. BIG-IP LTM logs showing oversized request from test source IP. Possible 400 Bad Request or connection reset depending on BIG-IP version.
- Test 2BIG-IP iControl REST Reconnaissance Prior to Exploitation
Expected signal: BIG-IP iControl REST access logs in `/var/log/restjavad.0.log` showing authenticated GET requests from test source IP. Network logs showing HTTPS connections to BIG-IP management IP on port 443.
- Test 3Simulate BIG-IP TMM Crash and Core Dump Generation
Expected signal: Syslog messages from BIG-IP host containing 'tmm' process restart events, critical severity entries, and potential core dump references in `/var/core/`. F5 SNMP traps if configured.
Unlock Pro Content
Get the full detection package for CVE-2025-53521 including response playbook, investigation guide, and atomic red team tests.