CVE-2025-61960
📋 TL;DR
A vulnerability in F5 BIG-IP APM allows undisclosed traffic to cause the Traffic Management Microkernel (TMM) to terminate when per-request policies are configured on portal access virtual servers. This affects BIG-IP APM users with specific configurations. Systems running end-of-technical-support versions are not evaluated but may be vulnerable.
💻 Affected Systems
- F5 BIG-IP APM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for all traffic through affected virtual servers, requiring manual intervention to restart TMM processes.
Likely Case
Intermittent service disruption affecting portal access functionality when specific traffic patterns trigger the condition.
If Mitigated
Minimal impact with proper network segmentation and traffic filtering in place.
🎯 Exploit Status
Undisclosed traffic can trigger the condition without authentication. Specific exploit details are not publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 K000156597 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000156597
Restart Required: Yes
Instructions:
1. Review F5 advisory K000156597 for affected versions. 2. Upgrade to fixed version listed in advisory. 3. Restart TMM processes after upgrade. 4. Verify configuration compatibility.
🔧 Temporary Workarounds
Remove per-request policies
allTemporarily remove per-request policies from portal access virtual servers to mitigate vulnerability
tmsh modify ltm virtual <virtual_server_name> policies remove { <policy_name> }
Implement traffic filtering
allUse iRules or network controls to filter suspicious traffic patterns
when HTTP_REQUEST { if { [HTTP::uri] contains "malicious_pattern" } { reject } }
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected virtual servers
- Deploy additional monitoring and alerting for TMM process restarts
🔍 How to Verify
Check if Vulnerable:
Check if per-request policies are configured on portal access virtual servers: tmsh list ltm virtual <name> policiesCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify BIG-IP version is updated to fixed version and TMM processes are stable📡 Detection & Monitoring
Log Indicators:
- TMM process termination events in /var/log/ltm
- Unexpected virtual server restarts
- High CPU/memory usage before crashes
Network Indicators:
- Unusual traffic patterns to portal access endpoints
- Increased connection resets
SIEM Query:
source="*/var/log/ltm*" AND "TMM terminated" OR "segmentation fault"