Cyber Posture

CVE-2025-22846

High

Published: 05 February 2025

Published
05 February 2025
Modified
10 September 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0042 61.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Security Summary

CVE-2025-22846 is a denial-of-service vulnerability affecting F5 BIG-IP systems. When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. The issue is classified under CWE-404 (Improper Resource Shutdown or Release) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). It was published on 2025-02-05.

A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. By sending the undisclosed traffic to the affected virtual server configuration, the attacker can terminate the TMM process, resulting in a denial of service that disrupts traffic management and availability.

F5 has published a security advisory at https://my.f5.com/manage/s/article/K000139780 addressing the vulnerability. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated.

Details

CWE(s)
CWE-404

Affected Products

f5
big-ip next service proxy for kubernetes
1.8.0, 1.8.1, 1.8.2, 1.9.0 · 1.7.0 — 1.7.7
f5
big-ip access policy manager
15.1.0 — 15.1.10.6.0.11.6 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip advanced firewall manager
15.1.0 — 15.1.10.6.0.11.6-ENG · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip analytics
15.1.0 — 15.1.10.6.0.11.6 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip application acceleration manager
15.1.0 — 15.1.10.6.0.11.6 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip application security manager
15.1.0 — 15.1.10.6.0.11.6 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip domain name system
15.1.0 — 15.1.10.6.0.11.6 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip fraud protection service
15.1.0 — 15.1.10.6.0.11.6 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip global traffic manager
15.1.0 — 15.1.10.6.0.11.6 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
f5
big-ip link controller
15.1.0 — 15.1.10.6.0.11.6 · 16.1.0 — 16.1.5 · 17.1.0 — 17.1.2
+2 more product configuration(s) — see NVD for full list

References