CVE-2025-48008
📋 TL;DR
This vulnerability affects F5 BIG-IP systems with TCP profiles configured with Multipath TCP (MPTCP) enabled on virtual servers. Under specific traffic conditions, it causes the Traffic Management Microkernel (TMM) to terminate, leading to denial of service. Only systems running supported software versions are affected.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
Big Ip Next Cloud Native Network Functions by F5
View all CVEs affecting Big Ip Next Cloud Native Network Functions →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption as TMM terminates, causing all traffic management functions to fail on affected virtual servers.
Likely Case
Intermittent service outages when specific MPTCP traffic patterns occur, requiring TMM restarts.
If Mitigated
No impact if MPTCP is disabled or systems are patched.
🎯 Exploit Status
Requires specific traffic conditions beyond attacker's control, making reliable exploitation challenging.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000150614 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000150614
Restart Required: Yes
Instructions:
1. Review F5 advisory K000150614. 2. Identify affected BIG-IP versions. 3. Apply recommended patches from F5 downloads. 4. Restart TMM services.
🔧 Temporary Workarounds
Disable MPTCP on TCP profiles
allRemove Multipath TCP configuration from vulnerable TCP profiles
tmsh modify ltm profile tcp <profile-name> multipath-tcp disabled
🧯 If You Can't Patch
- Disable MPTCP on all TCP profiles immediately
- Implement network controls to block MPTCP traffic to vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Check if any TCP profiles have multipath-tcp enabled: tmsh list ltm profile tcp multipath-tcpCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify patch version matches F5 advisory and confirm MPTCP is disabled or system is patched📡 Detection & Monitoring
Log Indicators:
- TMM process termination logs
- Unexpected service restarts in /var/log/ltm
Network Indicators:
- MPTCP traffic patterns to BIG-IP systems
- Service disruption on MPTCP-enabled virtual servers
SIEM Query:
source="*/var/log/ltm*" AND "TMM terminated" OR "multipath-tcp"