CVE-2025-20045
Published: 05 February 2025
Summary
CVE-2025-20045 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in F5 Big-Ip Access Policy Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 31.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the NULL pointer dereference flaw in TMM by applying vendor patches or workarounds specified in the F5 security advisory.
Provides denial-of-service protection mechanisms such as traffic filtering or rate limiting to block or mitigate the undisclosed SIP traffic triggering TMM crashes.
Ensures error handling in the SIP ALG processing prevents crashes from invalid traffic leading to NULL pointer dereferences.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing virtual server (T1190) via crafted traffic triggering application crash (T1499.004).
NVD Description
When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software…
more
versions which have reached End of Technical Support (EoTS) are not evaluated.
Deeper analysisAI
CVE-2025-20045 is a denial-of-service vulnerability affecting the Traffic Management Microkernel (TMM) in F5 BIG-IP systems. It occurs when a SIP session Application Level Gateway (ALG) profile with Passthru Mode enabled, combined with a SIP router ALG profile, is configured on a Message Routing type virtual server. In this scenario, undisclosed traffic triggers a NULL pointer dereference (CWE-476), causing the TMM to terminate. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Software versions that have reached End of Technical Support (EoTS) were not evaluated.
Remote attackers can exploit this vulnerability over the network without authentication or user interaction. By sending the undisclosed traffic to the affected virtual server under the specified SIP ALG configurations, an attacker can cause the TMM to crash, resulting in a denial of service that disrupts traffic processing and potentially requires manual restart or failover.
The F5 security advisory provides details on mitigation and affected versions at https://my.f5.com/manage/s/article/K000138932.
Details
- CWE(s)