CVE-2025-23412
Published: 05 February 2025
Description
When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Security Summary
CVE-2025-23412 affects F5 BIG-IP systems configured with an Access Policy Manager (APM) Access Profile on a virtual server. The vulnerability allows an undisclosed request to cause the Traffic Management Microkernel (TMM) to terminate, resulting in a denial-of-service condition. It is classified under CWE-120 (Buffer Copy without Checking Size of Input) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An unauthenticated attacker with network access to the vulnerable virtual server can exploit this issue with low complexity and no user interaction required. Exploitation triggers TMM termination, which disrupts traffic processing and may require manual intervention to restore service on the affected BIG-IP instance.
F5 security advisory K000141003, available at https://my.f5.com/manage/s/article/K000141003, details affected versions and recommended mitigations or patches. Software versions that have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.
Details
- CWE(s)