CVE-2025-54479
📋 TL;DR
This vulnerability in F5 BIG-IP systems allows remote attackers to cause denial of service by sending specially crafted requests to virtual servers with classification profiles but without HTTP/HTTP2 profiles. This affects BIG-IP administrators who have configured classification profiles on virtual servers without proper HTTP profiles.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Next Cloud Native Network Functions by F5
View all CVEs affecting Big Ip Next Cloud Native Network Functions →
Big Ip Next Cloud Native Network Functions by F5
View all CVEs affecting Big Ip Next Cloud Native Network Functions →
Big Ip Next Cloud Native Network Functions by F5
View all CVEs affecting Big Ip Next Cloud Native Network Functions →
Big Ip Next Cloud Native Network Functions by F5
View all CVEs affecting Big Ip Next Cloud Native Network Functions →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption as TMM (Traffic Management Microkernel) terminates, causing all traffic management functions to fail on affected systems.
Likely Case
Denial of service affecting specific virtual servers, requiring manual intervention to restart services.
If Mitigated
Minimal impact if proper HTTP/HTTP2 profiles are configured or classification profiles are removed from vulnerable configurations.
🎯 Exploit Status
Exploitation requires sending undisclosed requests to vulnerable configurations. No authentication required to trigger the TMM termination.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000151475 for specific fixed versions per release train
Vendor Advisory: https://my.f5.com/manage/s/article/K000151475
Restart Required: Yes
Instructions:
1. Review F5 advisory K000151475 for your specific version. 2. Download and apply the appropriate hotfix or upgrade to fixed version. 3. Restart TMM services as required. 4. Verify configuration changes persist after restart.
🔧 Temporary Workarounds
Remove classification profile from vulnerable virtual servers
allRemove classification profiles from virtual servers that don't have HTTP or HTTP/2 profiles configured
tmsh modify ltm virtual <virtual_server_name> profiles delete { classification }
Add HTTP or HTTP/2 profile to virtual servers with classification
allEnsure all virtual servers with classification profiles have either HTTP or HTTP/2 profiles configured
tmsh modify ltm virtual <virtual_server_name> profiles add { http }
🧯 If You Can't Patch
- Apply workaround to remove classification profiles from vulnerable virtual servers or add HTTP/HTTP2 profiles
- Implement network segmentation to restrict access to vulnerable virtual servers from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check virtual server configurations: tmsh list ltm virtual | grep -A5 -B5 'classification' and verify if HTTP/HTTP2 profiles are presentCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify patch installation with 'tmsh show sys version' and confirm vulnerable configurations are remediated📡 Detection & Monitoring
Log Indicators:
- TMM termination events in /var/log/ltm
- Unexpected service restarts
- Connection resets on virtual servers
Network Indicators:
- Sudden drop in traffic to specific virtual servers
- Increased TCP RST packets from BIG-IP
SIEM Query:
source="*/var/log/ltm*" AND "TMM terminated" OR "segmentation fault" AND "classification"