CVE-2025-20058
Published: 05 February 2025
Summary
CVE-2025-20058 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in F5 Big-Ip Access Policy Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely installation of vendor patches for the affected BIG-IP versions to prevent memory exhaustion from crafted traffic.
Provides denial-of-service protection mechanisms to detect and limit crafted traffic causing uncontrolled memory resource consumption on BIG-IP virtual servers.
Ensures resource availability by protecting memory from degradation due to denial-of-service events triggered by undisclosed traffic to message routing profiles.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote unauthenticated exploitation of a public-facing BIG-IP virtual server (T1190) via crafted traffic to trigger resource exhaustion and DoS (T1499.004).
NVD Description
When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Deeper analysisAI
CVE-2025-20058 is a denial-of-service vulnerability in F5 BIG-IP systems, specifically affecting configurations where a message routing profile is enabled on a virtual server. Undisclosed traffic directed at such a virtual server can trigger excessive memory resource utilization, classified under CWE-400 (Uncontrolled Resource Consumption). The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its potential for availability disruption without requiring authentication or user interaction. Only BIG-IP software versions still under technical support are evaluated for impact.
A remote, unauthenticated attacker can exploit this vulnerability by sending crafted traffic to the affected virtual server. Successful exploitation leads to increased memory consumption on the BIG-IP system, potentially resulting in resource exhaustion and denial-of-service conditions that impair the device's functionality and traffic processing capabilities.
F5 has published an advisory detailing the issue and mitigation strategies at https://my.f5.com/manage/s/article/K000140947. Security practitioners should consult this reference for specific affected versions, patch availability, and recommended configuration changes. Note that software versions at End of Technical Support (EoTS) are not evaluated.
Details
- CWE(s)