{"uuid": "3ecce3d2-38d0-4564-a7bb-bfbeebd36611", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-53521", "type": "seen", "source": "https://infosec.exchange/users/shadowserver/statuses/117094014735520376", "content": "We are scanning & reporting F5 BIG-IP APM CVE-2025-53521 instances thanks to collaboration with the NCSC-NL SRT. 10 months after vuln disclosure, we still see over 850 IPs vulnerable to potential RCE. Top affected: US with 199 & Japan 182. IP data in Vulnerable HTTP reporting.\nThis vulnerability is known to be exploited in the wild and on CISA KEV https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-53521\nF5 Advisory: https://my.f5.com/manage/s/article/K000156741\nCheck your reports for IPs tagged 'cve-2025-53521'!\nPublic Dashboard World Map: https://dashboard.shadowserver.org/statistics/combined/map/?date_range=1&map_type=std&source=http_vulnerable&tag=cve-2025-53521%2B&data_set=count&scale=log&auto_update=on\nVulnerable HTTP Report: https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/", "creation_timestamp": "2026-08-14T13:07:54.739931Z"}