CVE-2025-23412
📋 TL;DR
This vulnerability in BIG-IP APM allows an attacker to send specially crafted requests that cause the Traffic Management Microkernel (TMM) to terminate, resulting in denial of service. It affects F5 BIG-IP systems with APM Access Profile configured on virtual servers. Organizations using affected BIG-IP versions with APM functionality are vulnerable.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for all traffic passing through the BIG-IP system, requiring manual intervention to restart TMM processes.
Likely Case
Intermittent service disruption affecting APM-protected applications, potentially requiring TMM process restarts.
If Mitigated
Limited impact with proper network segmentation and request filtering in place.
🎯 Exploit Status
Requires sending specific undisclosed requests to vulnerable configuration. No authentication bypass indicated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000141003 for fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000141003
Restart Required: No
Instructions:
1. Review F5 advisory K000141003 for affected versions. 2. Upgrade to fixed version per F5 recommendations. 3. Apply patch following F5 standard upgrade procedures. 4. Verify TMM processes remain stable after upgrade.
🔧 Temporary Workarounds
Disable APM on vulnerable virtual servers
allRemove APM Access Profile configuration from virtual servers if not required
tmsh modify ltm virtual <virtual_server_name> profiles delete { <apm_profile_name> }
Implement request filtering
allUse iRules or security policies to filter suspicious requests
when HTTP_REQUEST { if { [HTTP::uri] contains "suspicious_pattern" } { reject } }
🧯 If You Can't Patch
- Implement network segmentation to restrict access to APM-configured virtual servers
- Deploy WAF or additional filtering layer in front of BIG-IP to block malicious requests
🔍 How to Verify
Check if Vulnerable:
Check if APM Access Profile is configured on any virtual server: tmsh list ltm virtual one-line | grep -i apmCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify BIG-IP version is updated to fixed version and monitor TMM process stability📡 Detection & Monitoring
Log Indicators:
- TMM process crashes in /var/log/ltm
- High frequency of connection resets
- APM access log anomalies
Network Indicators:
- Unusual request patterns to APM endpoints
- Sudden increase in connection failures
SIEM Query:
source="bigip_logs" AND ("TMM terminated" OR "segmentation fault" OR "access violation")