CVE-2025-46405
📋 TL;DR
A vulnerability in F5 BIG-IP APM allows undisclosed traffic to cause the Traffic Management Microkernel (TMM) to terminate when Network Access is configured. This affects BIG-IP systems with APM virtual servers configured for Network Access. The vulnerability can lead to denial of service.
💻 Affected Systems
- F5 BIG-IP APM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete TMM termination causing denial of service for all traffic through the affected virtual server, potentially affecting multiple applications and services.
Likely Case
Intermittent TMM crashes leading to service disruption and potential failover events in HA configurations.
If Mitigated
Limited impact with proper network segmentation and traffic filtering in place.
🎯 Exploit Status
The vulnerability requires sending specific undisclosed traffic to trigger the condition. No authentication is required to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000151546 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000151546
Restart Required: Yes
Instructions:
1. Review F5 advisory K000151546 for affected versions. 2. Upgrade to recommended fixed version. 3. Restart TMM services after patching. 4. Verify APM functionality post-upgrade.
🔧 Temporary Workarounds
Disable Network Access
allRemove Network Access configuration from APM virtual servers if not required
tmsh modify ltm virtual <virtual_server_name> profiles delete { <apm_profile_name> }
tmsh save sys config
Network Segmentation
allRestrict access to APM virtual servers using firewall rules
🧯 If You Can't Patch
- Implement strict network access controls to limit traffic to APM virtual servers
- Monitor TMM process health and implement automated restart procedures for service recovery
🔍 How to Verify
Check if Vulnerable:
Check if APM virtual servers have Network Access configured using: tmsh list ltm virtual <virtual_server_name> | grep -A5 -B5 'apm'Check Version:
tmsh show sys versionVerify Fix Applied:
Verify version is patched using version check command and confirm Network Access configuration is either removed or protected📡 Detection & Monitoring
Log Indicators:
- TMM termination events in /var/log/ltm
- APM access log anomalies
- System log entries indicating TMM crashes
Network Indicators:
- Unexpected traffic patterns to APM virtual servers
- Service disruption events
SIEM Query:
source="/var/log/ltm" AND "TMM terminated" OR source="/var/log/apm" AND "unexpected traffic"