CVE-2025-20045
📋 TL;DR
This vulnerability allows an attacker to cause a denial of service by sending specially crafted SIP traffic to F5 BIG-IP systems with specific ALG configurations. The Traffic Management Microkernel (TMM) terminates, disrupting traffic processing. Affects F5 BIG-IP systems with SIP ALG profiles configured on Message Routing virtual servers.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption as TMM terminates, requiring manual intervention to restore traffic processing.
Likely Case
Intermittent service outages affecting SIP traffic and potentially other services on the same BIG-IP device.
If Mitigated
No impact if vulnerable configurations are not present or traffic is filtered.
🎯 Exploit Status
Requires sending SIP traffic to vulnerable configuration but no authentication needed. Specific traffic patterns not disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check F5 advisory K000138932 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000138932
Restart Required: No
Instructions:
1. Review F5 advisory K000138932 for applicable fixed versions. 2. Upgrade to recommended version. 3. Verify configuration changes are not needed post-upgrade.
🔧 Temporary Workarounds
Disable vulnerable ALG configurations
F5 BIG-IPRemove or modify SIP ALG profiles on Message Routing virtual servers to eliminate vulnerable configuration.
tmsh modify ltm virtual <virtual_server_name> profiles delete { sip-session-alg-profile }
tmsh modify ltm virtual <virtual_server_name> profiles delete { sip-router-alg-profile }
🧯 If You Can't Patch
- Implement network filtering to block SIP traffic to vulnerable virtual servers.
- Monitor TMM process health and implement automated restart procedures for outages.
🔍 How to Verify
Check if Vulnerable:
Check if any virtual servers have both SIP session ALG profile with Passthru Mode enabled and SIP router ALG profile configured: tmsh list ltm virtual one-line | grep -E 'sip-session-alg|sip-router-alg'Check Version:
tmsh show sys versionVerify Fix Applied:
After patching, verify no TMM crashes occur during SIP traffic testing and check version is updated: tmsh show sys version📡 Detection & Monitoring
Log Indicators:
- TMM process termination logs in /var/log/ltm
- SIP ALG error messages in system logs
Network Indicators:
- Unusual SIP traffic patterns to Message Routing virtual servers
- Sudden loss of SIP service
SIEM Query:
source="/var/log/ltm" AND "TMM terminated" OR source="/var/log/messages" AND "sip.*alg.*error"