CVE-2025-20045 Overview
CVE-2025-20045 is a Null Pointer Dereference vulnerability affecting multiple F5 BIG-IP products. When a SIP session Application Level Gateway (ALG) profile with Passthru Mode enabled and a SIP router ALG profile are configured on a Message Routing type virtual server, specially crafted network traffic can cause the Traffic Management Microkernel (TMM) to terminate unexpectedly. This vulnerability allows remote unauthenticated attackers to cause a denial of service condition on affected F5 BIG-IP systems.
Critical Impact
Remote attackers can crash the TMM process, causing service disruption to all traffic passing through affected BIG-IP systems. This impacts network availability for organizations relying on F5 BIG-IP for load balancing, security, and application delivery.
Affected Products
- F5 BIG-IP Access Policy Manager
- F5 BIG-IP Advanced Firewall Manager
- F5 BIG-IP Advanced Web Application Firewall
- F5 BIG-IP Local Traffic Manager
- F5 BIG-IP Application Security Manager
- F5 BIG-IP SSL Orchestrator
- F5 BIG-IP Domain Name System
- F5 BIG-IP Global Traffic Manager
- F5 BIG-IP Policy Enforcement Manager
- F5 BIG-IP Carrier-Grade NAT
- F5 BIG-IP DDoS Hybrid Defender
- F5 BIG-IP Analytics
- F5 BIG-IP Application Acceleration Manager
- F5 BIG-IP Application Visibility and Reporting
- F5 BIG-IP Edge Gateway
- F5 BIG-IP Link Controller
- F5 BIG-IP WebAccelerator
- F5 BIG-IP WebSafe
- F5 BIG-IP Fraud Protection Service
- F5 BIG-IP Container Ingress Services
- F5 BIG-IP Automation Toolchain
Discovery Timeline
- February 5, 2025 - CVE-2025-20045 published to NVD
- October 21, 2025 - Last updated in NVD database
Technical Details for CVE-2025-20045
Vulnerability Analysis
This vulnerability is classified as CWE-476 (Null Pointer Dereference). The flaw exists within the Traffic Management Microkernel (TMM), which is a core component responsible for processing all network traffic on F5 BIG-IP systems. When specific SIP ALG configurations are in place, the TMM fails to properly handle certain traffic patterns, resulting in a null pointer dereference that causes the process to terminate.
The vulnerability requires a specific configuration scenario: a SIP session ALG profile with Passthru Mode enabled must be combined with a SIP router ALG profile on a Message Routing type virtual server. This configuration combination creates the conditions necessary for the vulnerability to be triggered.
The attack can be executed remotely over the network without requiring any authentication or user interaction. While the vulnerability does not allow attackers to gain access to or modify data on the system, the denial of service impact is significant as it affects the availability of all services processed by the affected BIG-IP system.
Root Cause
The root cause is a Null Pointer Dereference (CWE-476) in the TMM processing logic. When handling SIP protocol traffic through the configured ALG profiles on a Message Routing virtual server, the TMM encounters a code path where it attempts to dereference a pointer that has not been properly initialized or has been set to null. This occurs specifically when undisclosed traffic patterns are processed under the vulnerable configuration.
Attack Vector
The attack vector is network-based, requiring no authentication or privileges. An attacker can exploit this vulnerability by sending specially crafted network traffic to a BIG-IP system configured with the vulnerable SIP ALG profile combination. The undisclosed nature of the specific traffic patterns means that attackers with knowledge of the vulnerability could craft packets designed to trigger the TMM termination.
When exploited, the TMM process crashes, which can cause:
- Immediate disruption of all traffic processing through the affected virtual server
- Potential failover events in high-availability configurations
- Service degradation or outage for applications relying on the BIG-IP system
Detection Methods for CVE-2025-20045
Indicators of Compromise
- TMM process crashes or unexpected restarts in BIG-IP system logs
- Increased frequency of failover events between BIG-IP high-availability pairs
- Core dump files generated by TMM process terminations
- Anomalous SIP traffic patterns targeting the BIG-IP management or virtual server addresses
Detection Strategies
- Monitor /var/log/ltm for TMM restart events and error messages related to SIP processing
- Configure SNMP traps or syslog alerts for TMM process state changes
- Review core dump files in /var/core/ for evidence of null pointer dereference crashes
- Implement network monitoring to detect unusual SIP traffic volumes or malformed SIP packets
Monitoring Recommendations
- Enable BIG-IP audit logging for configuration changes to SIP ALG profiles
- Configure alerting thresholds for TMM restart frequency to detect potential exploitation attempts
- Monitor system health dashboards for unexpected service interruptions on Message Routing virtual servers
- Review network flow data for sources sending high volumes of SIP traffic to affected systems
How to Mitigate CVE-2025-20045
Immediate Actions Required
- Review BIG-IP configurations to identify systems with SIP session ALG profiles using Passthru Mode on Message Routing virtual servers
- Apply F5 security patches as outlined in the vendor security advisory
- Consider temporarily disabling vulnerable SIP ALG configurations if patching is not immediately possible
- Implement network-level filtering to restrict SIP traffic to trusted sources
Patch Information
F5 has released security updates to address this vulnerability. Administrators should consult the F5 Security Article K000138932 for detailed patch information, including specific version numbers and upgrade paths. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.
Organizations should prioritize patching based on exposure level, giving highest priority to internet-facing BIG-IP systems with the vulnerable SIP ALG configuration.
Workarounds
- Disable Passthru Mode on SIP session ALG profiles if not required for business functionality
- Remove SIP router ALG profile from Message Routing type virtual servers where possible
- Implement network access control lists to restrict SIP traffic sources to known, trusted endpoints
- Consider using alternative configurations that do not combine both SIP session ALG with Passthru Mode and SIP router ALG profiles
# Check for vulnerable SIP ALG configuration
tmsh list ltm profile sip-session all-properties | grep -A 10 "passthru-mode"
# List Message Routing virtual servers with SIP profiles
tmsh list ltm virtual | grep -B 5 -A 15 "message-routing"
# Review SIP router ALG profiles
tmsh list ltm profile sip-router
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
