CVE-2025-47150: F5 F5OS-A SNMP DoS Vulnerability

CVE-2025-47150 Overview

CVE-2025-47150 is a memory leak vulnerability [CWE-401] affecting F5OS Appliance and Chassis systems when Simple Network Management Protocol (SNMP) is configured. Undisclosed requests can cause an increase in SNMP memory resource utilization, leading to potential denial of service conditions on affected devices. The vulnerability requires low-privilege network access and does not require user interaction. F5 disclosed this issue in advisory K000149820. Software versions that have reached End of Technical Support (EoTS) were not evaluated by the vendor.

Critical Impact
Attackers with low privileges can remotely exhaust SNMP memory resources on F5OS Appliance and Chassis platforms, degrading device availability and potentially disrupting network operations dependent on these systems.

Affected Products

F5 F5OS-A (Appliance)
F5 F5OS-C (Chassis)
SNMP-configured deployments only

Discovery Timeline

2025-10-15 - CVE-2025-47150 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47150

Vulnerability Analysis

CVE-2025-47150 is classified as a Missing Release of Memory after Effective Lifetime issue [CWE-401]. When SNMP is configured on F5OS Appliance and Chassis systems, specifically crafted or repeated undisclosed requests cause the SNMP subsystem to consume increasing amounts of memory without releasing it. Sustained exploitation can exhaust available memory allocated to SNMP processing, degrading device responsiveness or triggering service instability.

The vulnerability targets the availability of the SNMP service and, by extension, the management plane of the affected F5OS platform. Confidentiality and integrity of data are not directly impacted. Attackers must have some level of authenticated access to reach the vulnerable code path over the network.

Root Cause

The root cause is improper memory management within the F5OS SNMP handling logic. Certain request patterns allocate memory that is not freed after the request completes, matching the behavior described by CWE-401 (Memory Leak). Over time, this growth reduces the memory pool available for legitimate SNMP operations and other system functions.

Attack Vector

Exploitation requires network-adjacent access to the SNMP service on an affected F5OS Appliance or Chassis system, along with low-level privileges. An attacker sends repeated undisclosed SNMP requests that trigger the leaking code path. F5 has not publicly disclosed the specific request structure. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-47150

Indicators of Compromise

Sustained upward trend in SNMP process memory consumption on F5OS Appliance or Chassis systems without a corresponding change in monitored device count
Elevated rate of SNMP requests from a single low-privileged source over short time windows
SNMP service instability, timeouts, or restarts on affected F5OS platforms
System log entries indicating memory pressure on the management plane

Detection Strategies

Baseline normal SNMP memory utilization on F5OS systems and alert on deviations that exceed established thresholds
Correlate SNMP query volume with memory growth to distinguish operational polling from anomalous request patterns
Inspect authenticated SNMP session logs for repeated identical or malformed queries from the same principal

Monitoring Recommendations

Continuously monitor SNMP daemon memory allocation and free-memory metrics on F5OS-A and F5OS-C devices
Forward F5OS management-plane logs and SNMP telemetry to a centralized SIEM for correlation and long-term retention
Alert on abnormal SNMP request rates or unexpected client sources contacting the management interface

How to Mitigate CVE-2025-47150

Immediate Actions Required

Review the F5 advisory K000149820 and identify affected F5OS Appliance and Chassis versions in your environment
Restrict SNMP access on F5OS management interfaces to trusted management networks and authorized monitoring stations only
Verify that deployed F5OS versions are within the F5 Technical Support window, as EoTS versions are not evaluated
Increase monitoring of SNMP memory utilization until patches are applied

Patch Information

F5 has published remediation guidance in the vendor advisory. Refer to the F5 Technical Article K000149820 for the list of fixed F5OS-A and F5OS-C releases and upgrade instructions.

Workarounds

Disable SNMP on F5OS Appliance and Chassis systems where it is not operationally required
Apply access control lists (ACLs) to permit SNMP traffic only from designated monitoring hosts
Enforce SNMPv3 with authentication and privacy to limit the population of principals able to reach the affected code path
Segment the F5OS management network from user and untrusted networks to reduce exposure

bash

# Configuration example: restrict SNMP access to trusted monitoring subnet
# Consult F5 documentation for exact F5OS CLI syntax
system snmp access-list trusted-monitors {
    allowed-networks 10.10.20.0/24
}