Detect F5 BIG-IP Stack-Based Buffer Overflow Exploitation (CVE-2025-53521) in Sumo Logic CSE
Detects exploitation attempts and post-exploitation activity related to CVE-2025-53521, a stack-based buffer overflow vulnerability (CWE-121) in F5 BIG-IP. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and may allow remote attackers to execute arbitrary code or cause denial of service by sending crafted requests that overflow stack buffers in BIG-IP processing components.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=f5/bigip OR _sourceCategory=network/f5 OR _sourceName=*bigip*
| where _raw matches /(?i)(buffer overflow|stack overflow|stack smash|segmentation fault|segfault|tmm crash|mcpd crash|core dump|CVE-2025-53521|K000156741|K000160486)/
| parse regex "(?P<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" as src_ip nodrop
| parse regex "severity=(?P<severity>\\w+)" as severity nodrop
| parse regex "(?P<process>tmm|mcpd|httpd|tmsh)" as process nodrop
| timeslice 5m
| count as event_count, values(src_ip) as source_ips, values(severity) as severities, values(process) as affected_processes by _timeslice, _sourceHost
| where event_count > 1
| sort by event_count descSumo Logic query across F5 BIG-IP source categories searching for buffer/stack overflow indicators and crash signals, aggregated in 5-minute windows to surface burst exploitation patterns.
Data Sources
Required Tables
False Positives & Tuning
- F5 advisory monitoring pipelines injecting CVE strings into log aggregation streams
- BIG-IP rolling restarts during maintenance windows generating crash-like log entries
- Penetration test engagements targeting BIG-IP in authorized lab environments
- High-volume legitimate traffic bursts causing transient memory pressure and related log messages
Other platforms for CVE-2025-53521
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Oversized HTTP POST Payload to BIG-IP Virtual Server
Expected signal: Network flow logs showing source IP sending >65535 bytes to BIG-IP destination port. BIG-IP LTM logs showing oversized request from test source IP. Possible 400 Bad Request or connection reset depending on BIG-IP version.
- Test 2BIG-IP iControl REST Reconnaissance Prior to Exploitation
Expected signal: BIG-IP iControl REST access logs in `/var/log/restjavad.0.log` showing authenticated GET requests from test source IP. Network logs showing HTTPS connections to BIG-IP management IP on port 443.
- Test 3Simulate BIG-IP TMM Crash and Core Dump Generation
Expected signal: Syslog messages from BIG-IP host containing 'tmm' process restart events, critical severity entries, and potential core dump references in `/var/core/`. F5 SNMP traps if configured.
Unlock Pro Content
Get the full detection package for CVE-2025-53521 including response playbook, investigation guide, and atomic red team tests.