CVE-2025-46405: F5 BIG-IP APM DoS Vulnerability

CVE-2025-46405 Overview

CVE-2025-46405 is a stack-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM) systems. When Network Access is configured on a BIG-IP APM virtual server, specially crafted undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate unexpectedly. This vulnerability enables remote attackers to trigger a denial of service condition without requiring authentication or user interaction.

The TMM is a critical component responsible for handling all application traffic processing within the BIG-IP system. Its termination results in service disruption and potential failover events, significantly impacting network availability for organizations relying on BIG-IP APM for secure remote access.

Critical Impact

Remote unauthenticated attackers can crash the Traffic Management Microkernel, causing complete service disruption for all users accessing resources through the affected BIG-IP APM virtual server.

Affected Products

• F5 BIG-IP Access Policy Manager (multiple versions)
• BIG-IP APM virtual servers with Network Access configured
• F5 BIG-IP systems not yet patched per K000151546 advisory

Discovery Timeline

• 2025-08-13 - CVE-2025-46405 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-46405

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), indicating a memory corruption flaw within the Traffic Management Microkernel processing logic. The TMM component handles all network traffic for BIG-IP services, making it a high-value target for denial of service attacks.

The flaw exists in how the TMM processes certain types of network traffic when Network Access features are enabled on an APM virtual server. When malformed or specially crafted packets are sent to the affected system, the TMM fails to properly validate input boundaries, resulting in a stack buffer overflow that causes the process to crash.

Since the vulnerability requires no authentication and can be exploited remotely over the network, it presents a significant risk to organizations using BIG-IP APM for VPN and secure remote access services. The attack does not compromise confidentiality or integrity but severely impacts availability.

Root Cause

The root cause is a stack-based buffer overflow (CWE-121) in the Traffic Management Microkernel. Insufficient bounds checking during the processing of network traffic allows an attacker to overflow stack memory, leading to TMM termination. The vulnerability specifically manifests when Network Access is configured, suggesting the flaw resides in code paths handling Network Access tunnel processing or session management.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker needs network access to the BIG-IP APM virtual server where Network Access is configured. By sending specially crafted traffic to the target system, the attacker can trigger the buffer overflow condition, causing the TMM to crash.

The attack has low complexity and can be executed with minimal effort once network connectivity to the vulnerable virtual server is established. Each successful exploitation results in TMM termination, requiring recovery time and potentially triggering failover events in high-availability configurations.

The vulnerability manifests in the TMM's handling of network traffic when Network Access is configured on a virtual server. The exact packet structure required to trigger the overflow has not been publicly disclosed by F5 to prevent exploitation. Refer to the F5 Security Advisory K000151546 for technical details on affected versions and patch information.

Detection Methods for CVE-2025-46405

Indicators of Compromise

• Unexpected TMM process crashes or restarts in BIG-IP system logs
• Multiple failover events in high-availability configurations without apparent cause
• Increased frequency of core dump files related to TMM termination
• Anomalous network traffic patterns targeting APM virtual servers with Network Access enabled

Detection Strategies

• Monitor BIG-IP system logs for TMM termination events using /var/log/ltm and /var/log/tmm log files
• Configure SNMP traps or syslog forwarding for TMM process state changes
• Implement network traffic analysis to identify unusual packet patterns targeting APM virtual servers
• Review core dump files in /var/core/ for evidence of stack-based buffer overflow exploitation

Monitoring Recommendations

• Enable enhanced logging for APM virtual servers with Network Access configured
• Deploy SentinelOne agents to monitor for abnormal process behavior and crash patterns on BIG-IP management interfaces
• Establish baseline metrics for TMM process stability and alert on deviations
• Configure high-availability monitoring to detect rapid failover conditions indicative of DoS attacks

How to Mitigate CVE-2025-46405

Immediate Actions Required

• Review the F5 Security Advisory K000151546 for specific affected version ranges
• Identify all BIG-IP APM virtual servers with Network Access configured in your environment
• Apply the appropriate F5 security patches as specified in the advisory
• Implement network access controls to restrict traffic sources to APM virtual servers where possible

Patch Information

F5 has released security updates to address this vulnerability. Organizations should consult the F5 Security Advisory K000151546 for specific patch versions applicable to their BIG-IP deployment. Software versions that have reached End of Technical Support (EoTS) are not evaluated and may require upgrade to a supported release.

Patches should be applied during scheduled maintenance windows following F5's recommended upgrade procedures. High-availability configurations should leverage rolling upgrades to minimize service disruption during patching.

Workarounds

• Implement strict network access controls to limit which source IPs can reach APM virtual servers
• Consider temporarily disabling Network Access on non-critical virtual servers until patches can be applied
• Deploy web application firewall rules to filter potentially malicious traffic destined for APM services
• Ensure high-availability configurations are properly operational to minimize impact from potential TMM crashes

# Configuration example - Restrict access to APM virtual server
# Add this to BIG-IP configuration to limit source addresses
# Replace 10.0.0.0/8 with your trusted network ranges

tmsh create security firewall address-list trusted_sources addresses add { 10.0.0.0/8 192.168.0.0/16 }
tmsh create security firewall rule-list apm_protection rules add { allow_trusted { action accept source { address-lists add { trusted_sources } } } deny_others { action drop } }