Cyber Posture

CVE-2025-20045

High

Published: 05 February 2025

Published
05 February 2025
Modified
21 October 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0056 68.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Security Summary

CVE-2025-20045 is a denial-of-service vulnerability affecting the Traffic Management Microkernel (TMM) in F5 BIG-IP systems. It occurs when a SIP session Application Level Gateway (ALG) profile with Passthru Mode enabled, combined with a SIP router ALG profile, is configured on a Message Routing type virtual server. In this scenario, undisclosed traffic triggers a NULL pointer dereference (CWE-476), causing the TMM to terminate. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Software versions that have reached End of Technical Support (EoTS) were not evaluated.

Remote attackers can exploit this vulnerability over the network without authentication or user interaction. By sending the undisclosed traffic to the affected virtual server under the specified SIP ALG configurations, an attacker can cause the TMM to crash, resulting in a denial of service that disrupts traffic processing and potentially requires manual restart or failover.

The F5 security advisory provides details on mitigation and affected versions at https://my.f5.com/manage/s/article/K000138932.

Details

CWE(s)
CWE-476

Affected Products

f5
big-ip access policy manager
15.1.0 — 15.1.10 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip advanced firewall manager
15.1.0 — 15.1.10 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip advanced web application firewall
15.1.0 — 15.1.10 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip analytics
15.1.0 — 15.1.10 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip application acceleration manager
15.1.0 — 15.1.10 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip application security manager
15.1.0 — 15.1.10 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip application visibility and reporting
15.1.0 — 15.1.10 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip automation toolchain
15.1.0 — 15.1.10 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip carrier-grade nat
15.1.0 — 15.1.10 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip container ingress services
15.1.0 — 15.1.10 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
+11 more product configuration(s) — see NVD for full list

References