CVE-2025-22891: F5 BIG-IP PEM DoS Vulnerability

CVE-2025-22891 Overview

CVE-2025-22891 is a high-severity denial of service vulnerability affecting F5 BIG-IP Policy Enforcement Manager (PEM). When a BIG-IP PEM Control Plane listener Virtual Server is configured with a Diameter Endpoint profile, specially crafted undisclosed traffic can cause the Virtual Server to stop processing new client connections while simultaneously increasing memory resource utilization. This resource exhaustion condition can lead to service degradation or complete unavailability of affected systems.

Critical Impact

Attackers can remotely trigger a denial of service condition by sending malicious traffic to BIG-IP PEM Virtual Servers configured with Diameter Endpoint profiles, causing service disruption and memory exhaustion without authentication.

Affected Products

• F5 BIG-IP Policy Enforcement Manager (multiple versions)

Discovery Timeline

• February 5, 2025 - CVE-2025-22891 published to NVD
• August 6, 2025 - Last updated in NVD database

Technical Details for CVE-2025-22891

Vulnerability Analysis

This vulnerability is classified as CWE-772 (Missing Release of Resource after Effective Lifetime), commonly known as a memory leak. The flaw exists in the Diameter Endpoint profile implementation within BIG-IP PEM Control Plane listener Virtual Servers. When the affected component processes certain types of network traffic, it fails to properly release allocated memory resources after they are no longer needed.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without requiring any authentication or user interaction. The attack complexity is low, making it relatively straightforward for adversaries to trigger the denial of service condition. While the vulnerability does not impact confidentiality or integrity, it poses a significant threat to system availability.

Root Cause

The root cause stems from improper resource management in the Diameter protocol handling code. When BIG-IP PEM processes Diameter protocol messages through a configured Diameter Endpoint profile, certain traffic patterns trigger a code path where allocated memory is not properly freed. Over time, this leads to progressive memory exhaustion, eventually causing the Virtual Server to become unresponsive to new connection requests.

Attack Vector

The attack vector is network-based, targeting BIG-IP PEM Virtual Servers that are configured with Diameter Endpoint profiles. An attacker can send specially crafted traffic to the vulnerable Virtual Server from a remote location. The "undisclosed traffic" nature of the vulnerability suggests that the specific malicious payloads have not been publicly detailed to prevent exploitation.

The attack does not require:

• Authentication credentials
• User interaction
• Local system access
• Special privileges

This makes the vulnerability particularly dangerous in environments where BIG-IP PEM systems are exposed to untrusted networks.

Detection Methods for CVE-2025-22891

Indicators of Compromise

• Unexplained memory growth on BIG-IP PEM systems with Diameter Endpoint profiles
• Virtual Servers failing to accept new client connections
• System performance degradation correlating with increased Diameter protocol traffic
• Memory exhaustion alerts or warnings in BIG-IP system logs

Detection Strategies

• Monitor memory utilization trends on BIG-IP PEM appliances, alerting on sustained increases
• Implement connection tracking to detect when Virtual Servers stop accepting new connections
• Review BIG-IP system logs for memory-related warnings or errors
• Deploy network traffic analysis to identify anomalous Diameter protocol patterns

Monitoring Recommendations

• Configure SNMP or API-based monitoring for memory usage thresholds on BIG-IP PEM devices
• Set up alerts for Virtual Server connection acceptance failures
• Enable detailed logging on Diameter Endpoint profile activity for forensic analysis
• Establish baseline memory profiles to detect abnormal consumption patterns

How to Mitigate CVE-2025-22891

Immediate Actions Required

• Review all BIG-IP PEM Virtual Server configurations to identify those using Diameter Endpoint profiles
• Consult the F5 Security Advisory K000139778 for specific patch information
• Apply available security updates from F5 as soon as possible
• Consider restricting network access to affected Virtual Servers from untrusted sources

Patch Information

F5 has released security updates to address this vulnerability. Administrators should refer to the F5 Support Article K000139778 for detailed information about affected versions and available patches. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated and may remain vulnerable.

Workarounds

• Implement network access controls to limit traffic to Diameter Endpoint profile Virtual Servers from trusted sources only
• Configure rate limiting on affected Virtual Servers to mitigate the impact of exploitation attempts
• Monitor memory utilization closely and schedule periodic restarts if patching cannot be immediately applied
• Consider temporarily disabling Diameter Endpoint profiles if not actively required for operations

# Example: Review BIG-IP PEM Virtual Server configurations for Diameter Endpoint profiles
# Consult F5 documentation for specific CLI commands applicable to your version
tmsh list ltm virtual all | grep -A 10 "diameter"