CVE-2025-20058
📋 TL;DR
This vulnerability in F5 BIG-IP message routing profiles allows undisclosed traffic to cause excessive memory consumption, potentially leading to denial of service. It affects BIG-IP systems with message routing profiles configured on virtual servers. Organizations using vulnerable BIG-IP versions with this specific configuration are at risk.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
⚠️ Risk & Real-World Impact
Worst Case
Complete system outage due to memory exhaustion, causing denial of service for all services running on the affected BIG-IP device.
Likely Case
Degraded performance and intermittent service disruptions as memory resources become constrained.
If Mitigated
Minimal impact with proper monitoring and resource limits in place, though some performance degradation may still occur.
🎯 Exploit Status
Exploitation requires sending specific traffic patterns to trigger memory consumption. The exact traffic patterns are undisclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000140947 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000140947
Restart Required: No
Instructions:
1. Review F5 advisory K000140947 for affected versions. 2. Upgrade to a fixed version listed in the advisory. 3. No restart required for the patch application.
🔧 Temporary Workarounds
Remove Message Routing Profile
allTemporarily remove message routing profiles from virtual servers if not required for functionality
tmsh modify ltm virtual <virtual_server_name> profiles delete { <message_routing_profile_name> }
Implement Rate Limiting
allConfigure rate limiting on virtual servers with message routing profiles to limit traffic volume
tmsh create ltm profile rate-shaping <profile_name>
🧯 If You Can't Patch
- Implement strict network segmentation to limit traffic to affected virtual servers
- Deploy additional monitoring for memory utilization on BIG-IP systems with message routing profiles
🔍 How to Verify
Check if Vulnerable:
Check if any virtual servers have message routing profiles configured using: tmsh list ltm virtual one-line | grep -i message-routingCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify version is updated to a fixed version from the F5 advisory and check memory utilization patterns📡 Detection & Monitoring
Log Indicators:
- Unusual memory consumption spikes in /var/log/ltm
- High memory utilization alerts in system logs
Network Indicators:
- Abnormal traffic patterns to virtual servers with message routing profiles
- Increased packet rates to specific services
SIEM Query:
source="bigip_logs" ("memory" AND "high" AND "utilization") OR ("message-routing" AND "traffic" AND "spike")