CVE-2025-21091
Published: 05 February 2025
Summary
CVE-2025-21091 is a high-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in F5 Big-Ip Access Policy Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the memory leak flaw (CWE-401) in BIG-IP systems when SNMP v1/v2c is disabled by identifying, reporting, and applying vendor patches.
Enforces denial-of-service protections such as rate limiting and resource quotas to block unauthenticated requests causing memory exhaustion.
Protects memory resource availability from unauthorized depletion by the undisclosed requests targeting BIG-IP systems.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploitation of public-facing BIG-IP service triggers memory exhaustion DoS via crafted requests.
NVD Description
When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Deeper analysisAI
CVE-2025-21091 affects F5 BIG-IP systems when SNMP v1 or v2c are disabled, allowing undisclosed requests to cause an increase in memory resource utilization. This vulnerability, published on 2025-02-05, is classified under CWE-401 (Memory Leak) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its potential for availability impact.
Unauthenticated attackers with network access can exploit this issue with low attack complexity and no user interaction required. Exploitation involves sending the undisclosed requests, leading to memory exhaustion and potential denial-of-service conditions on the affected BIG-IP system.
Mitigation details are available in the F5 security advisory at https://my.f5.com/manage/s/article/K000140933. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated.
Details
- CWE(s)