CVE-2025-21091: F5 BIG-IP Access Policy Manager DoS Flaw

CVE-2025-21091 Overview

CVE-2025-21091 is a memory resource exhaustion vulnerability affecting F5 BIG-IP products. The flaw exists when Simple Network Management Protocol (SNMP) v1 or v2c are disabled on the BIG-IP system. Undisclosed requests sent to the device can trigger an increase in memory resource utilization, leading to a denial of service condition.

The vulnerability is categorized as a missing release of memory after effective lifetime issue ([CWE-401]). It is remotely exploitable over the network without authentication or user interaction. F5 notes that software versions which have reached End of Technical Support (EoTS) are not evaluated.

Critical Impact
Unauthenticated remote attackers can cause memory exhaustion on BIG-IP systems, impacting availability of critical network and security services across more than 20 affected product modules.

Affected Products

F5 BIG-IP Local Traffic Manager, Access Policy Manager, and Advanced Firewall Manager
F5 BIG-IP Advanced Web Application Firewall, Application Security Manager, and SSL Orchestrator
F5 BIG-IP DDoS Hybrid Defender, DNS, Global Traffic Manager, Link Controller, and Policy Enforcement Manager

Discovery Timeline

2025-02-05 - CVE-2025-21091 published to NVD
2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-21091

Vulnerability Analysis

The vulnerability resides in the SNMP handling logic of F5 BIG-IP systems. When administrators disable SNMP v1 or v2c, the system should reject related requests cleanly. Instead, undisclosed requests cause the system to consume increasing amounts of memory.

The weakness maps to [CWE-401], indicating that memory allocated during request processing is not released after its effective lifetime. Repeated requests amplify the resource consumption, eventually degrading system performance or causing service disruption. The condition affects the availability of the BIG-IP control plane and any traffic-processing modules running on the appliance.

F5 has not publicly disclosed the specific request format that triggers the condition, limiting third-party reproduction.

Root Cause

The root cause is improper memory management in the SNMP request handling path when SNMP v1 or v2c are administratively disabled. The processing code allocates memory for handling incoming requests but fails to release those allocations when the protocol is disabled. This produces a cumulative memory leak under sustained request volume.

Attack Vector

An unauthenticated attacker with network access to the BIG-IP management or data plane sends crafted requests to the SNMP service endpoint. Because exploitation requires no privileges, no user interaction, and low attack complexity, internet-exposed BIG-IP instances are at elevated risk. Successful exploitation drives memory utilization upward until services degrade or become unavailable.

No public exploit code or proof-of-concept has been published for this vulnerability. F5 documents the issue in F5 Support Article K000140933.

Detection Methods for CVE-2025-21091

Indicators of Compromise

Sustained upward growth of tmm or SNMP daemon memory utilization on BIG-IP systems where SNMP v1/v2c is disabled
Unexpected SNMP-related requests reaching the BIG-IP management interface or self IPs from untrusted networks
BIG-IP high-availability failover events or service restarts correlated with memory pressure alarms

Detection Strategies

Monitor BIG-IP memory utilization metrics through F5 iHealth, AVR, or SNMP polling from a trusted host and alert on abnormal growth trends
Inspect network flow logs for inbound UDP/161 and TCP/161 traffic to BIG-IP self IPs from unauthorized sources
Correlate F5 audit logs and ltm logs for SNMP processing errors with system resource alarms

Monitoring Recommendations

Establish baselines for SNMP daemon memory consumption and alert on deviations exceeding the baseline by a defined threshold
Enable centralized logging of BIG-IP system logs to a SIEM and create rules for SNMP-related anomalies
Review packet filter and port lockdown configurations on self IPs periodically to confirm enforcement

How to Mitigate CVE-2025-21091

Immediate Actions Required

Identify all BIG-IP instances running supported versions and review SNMP configuration state
Apply the fixed software versions referenced in F5 Support Article K000140933 as soon as maintenance windows permit
Restrict network access to SNMP service ports (UDP/161) on BIG-IP self IPs and management interfaces to trusted hosts only

Patch Information

F5 has published remediation guidance in F5 Support Article K000140933. Administrators should upgrade affected BIG-IP modules to the engineering hotfix or fixed release listed in the advisory. Versions that have reached End of Technical Support are not evaluated and should be upgraded to a supported release.

Workarounds

Configure port lockdown on BIG-IP self IPs to deny SNMP traffic from untrusted sources
Apply packet filter rules on the BIG-IP to drop SNMP requests from networks that do not require management access
Place BIG-IP management interfaces on a dedicated, access-controlled management network segment

bash

# Example: Restrict SNMP access on BIG-IP self IP using tmsh
tmsh modify net self <self_ip_name> allow-service { tcp:443 tcp:22 }
tmsh save sys config