CVE-2025-54479

Summary

When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected Software

VendorProductVersion RangeStatus
F5BIG-IP17.5.0 < 17.5.1affected
F5BIG-IP17.1.0 < 17.1.3affected
F5BIG-IP16.1.0 < 16.1.6.1affected
F5BIG-IP15.1.0 < 15.1.10.8affected
F5BIG-IP Next CNF2.0.0 < *affected
F5BIG-IP Next CNF1.1.0 < *affected
F5BIG-IP Next for Kubernetes2.0.0 < *affected

Weaknesses

  • CWE-787: CWE-787: Out-of-bounds Write

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References