CVE-2025-24497
📋 TL;DR
This vulnerability in F5 BIG-IP systems allows attackers to cause Traffic Management Microkernel (TMM) termination by sending specific requests to virtual servers with URL categorization enabled. This leads to denial of service, affecting availability of network services. Organizations running affected F5 BIG-IP versions with URL categorization configured are vulnerable.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption with TMM termination causing all traffic through the affected virtual server to be dropped, potentially affecting multiple applications and services.
Likely Case
Intermittent service outages as TMM restarts, causing temporary traffic disruption and potential session loss for users.
If Mitigated
Minimal impact if proper monitoring and automatic failover mechanisms are in place to handle TMM restarts.
🎯 Exploit Status
Exploitation requires sending specific requests to vulnerable virtual servers but does not require authentication. The exact request pattern is undisclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in: 17.1.1.2, 16.1.5.1, 15.1.11.1, 14.1.6.1, 13.1.6.1
Vendor Advisory: https://my.f5.com/manage/s/article/K000140920
Restart Required: Yes
Instructions:
1. Download appropriate fixed version from F5 Downloads. 2. Backup current configuration. 3. Install update following F5 upgrade procedures. 4. Restart TMM services. 5. Verify functionality.
🔧 Temporary Workarounds
Disable URL Categorization
F5 BIG-IPTemporarily disable URL categorization on vulnerable virtual servers to prevent exploitation while planning patching.
tmsh modify ltm virtual <virtual_server_name> security url-categorization disabled
🧯 If You Can't Patch
- Implement network segmentation to restrict access to virtual servers with URL categorization enabled
- Deploy WAF or IPS rules to block suspicious requests patterns targeting URL categorization functionality
🔍 How to Verify
Check if Vulnerable:
Check if running affected version: tmsh show sys version. Check URL categorization status: tmsh list ltm virtual <name> security | grep url-categorizationCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify version is patched: tmsh show sys version. Monitor TMM process stability and check logs for termination events.📡 Detection & Monitoring
Log Indicators:
- TMM termination events in /var/log/ltm
- Unexpected TMM restarts
- High frequency of requests to URL categorization endpoints
Network Indicators:
- Sudden drop in traffic to specific virtual servers
- Increased error responses from BIG-IP
SIEM Query:
source="*/var/log/ltm*" AND "TMM terminated" OR "TMM restarting"