CVE-2025-22846
Published: 05 February 2025
Description
When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Security Summary
CVE-2025-22846 is a denial-of-service vulnerability affecting F5 BIG-IP systems. When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. The issue is classified under CWE-404 (Improper Resource Shutdown or Release) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). It was published on 2025-02-05.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. By sending the undisclosed traffic to the affected virtual server configuration, the attacker can terminate the TMM process, resulting in a denial of service that disrupts traffic management and availability.
F5 has published a security advisory at https://my.f5.com/manage/s/article/K000139780 addressing the vulnerability. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated.
Details
- CWE(s)