CVE-2025-22846
Published: 05 February 2025
Summary
CVE-2025-22846 is a high-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in F5 Big-Ip Next Service Proxy For Kubernetes. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 38.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly addresses the vulnerability by applying F5 patches to fix the TMM termination issue triggered by SIP ALG traffic.
Denial-of-service protection identifies and blocks or rate-limits the undisclosed traffic exploiting the vulnerable virtual server configuration.
Least functionality restricts enabling unnecessary SIP Session and Router ALG profiles on Message Routing virtual servers, preventing the vulnerable condition.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote exploitation of a crafted traffic condition to crash the TMM process on a public-facing virtual server, directly mapping to application/system exploitation for endpoint denial of service.
NVD Description
When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not…
more
evaluated.
Deeper analysisAI
CVE-2025-22846 is a denial-of-service vulnerability affecting F5 BIG-IP systems. When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. The issue is classified under CWE-404 (Improper Resource Shutdown or Release) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). It was published on 2025-02-05.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low attack complexity and no user interaction required. By sending the undisclosed traffic to the affected virtual server configuration, the attacker can terminate the TMM process, resulting in a denial of service that disrupts traffic management and availability.
F5 has published a security advisory at https://my.f5.com/manage/s/article/K000139780 addressing the vulnerability. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated.
Details
- CWE(s)