CVE-2025-21091
Published: 05 February 2025
Description
When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Security Summary
CVE-2025-21091 affects F5 BIG-IP systems when SNMP v1 or v2c are disabled, allowing undisclosed requests to cause an increase in memory resource utilization. This vulnerability, published on 2025-02-05, is classified under CWE-401 (Memory Leak) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its potential for availability impact.
Unauthenticated attackers with network access can exploit this issue with low attack complexity and no user interaction required. Exploitation involves sending the undisclosed requests, leading to memory exhaustion and potential denial-of-service conditions on the affected BIG-IP system.
Mitigation details are available in the F5 security advisory at https://my.f5.com/manage/s/article/K000140933. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated.
Details
- CWE(s)