CVE-2025-61951: F5 BIG-IP Access Policy Manager DoS Flaw

CVE-2025-61951 Overview

CVE-2025-61951 is a high-severity denial-of-service vulnerability in F5 BIG-IP affecting the Traffic Management Microkernel (TMM). Undisclosed traffic can cause TMM to terminate when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is enabled with a Server SSL profile configured with a certificate, key, and the SSL Sign Hash set to ANY, and the backend server is enabled with DTLS 1.2 and client authentication. The flaw is tracked under [CWE-125] (Out-of-Bounds Read) and impacts traffic availability across the BIG-IP module suite. F5 notes that software versions which have reached End of Technical Support (EoTS) are not evaluated.

Critical Impact

A remote, unauthenticated attacker can crash the TMM process, disrupting all data-plane traffic flowing through affected BIG-IP virtual servers.

Affected Products

• F5 BIG-IP Local Traffic Manager (LTM) and Access Policy Manager (APM)
• F5 BIG-IP Advanced Firewall Manager (AFM), Application Security Manager (ASM), and Advanced WAF
• F5 BIG-IP SSL Orchestrator, DNS, Link Controller, and other modules through version 17.5.0

Discovery Timeline

• 2025-10-15 - CVE-2025-61951 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-61951

Vulnerability Analysis

The Traffic Management Microkernel is the core data-plane process in F5 BIG-IP. It handles all client and server-side traffic, including TLS and DTLS termination. CVE-2025-61951 allows specific undisclosed traffic patterns to terminate TMM when a narrow but realistic configuration is present.

The issue surfaces during DTLS 1.2 handshakes that involve backend client authentication and a Server SSL profile with SSL Sign Hash set to ANY. The combination causes TMM to read memory outside the expected bounds, classified as [CWE-125]. When TMM terminates, the BIG-IP system fails over or restarts the process, breaking active sessions and stopping new connections through the affected virtual servers.

Root Cause

The root cause is an out-of-bounds read inside the DTLS 1.2 server-side SSL handling path. When the SSL Sign Hash is set to ANY, TMM does not properly constrain memory access while negotiating hash and signature algorithms with a backend that requires client certificate authentication. Specially crafted or unexpected traffic triggers the unsafe read and crashes the process.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker capable of sending traffic to a vulnerable DTLS 1.2 virtual server can trigger the condition. Exploitation results in loss of availability of the TMM data plane, classified by F5 as a denial-of-service impact. No public proof-of-concept or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA KEV catalog.

For exploitation specifics, refer to the F5 Security Advisory K000151309.

Detection Methods for CVE-2025-61951

Indicators of Compromise

• Unexpected TMM core dumps or tmm process restarts logged in /var/log/ltm correlated with DTLS 1.2 traffic.
• Sudden loss of connectivity through DTLS 1.2 virtual servers, followed by automatic failover events on HA pairs.
• SNMP traps or alerts indicating tmmCrashedNotice or service interruption on virtual servers with Server SSL profiles using SSL Sign Hash = ANY.

Detection Strategies

• Audit BIG-IP configurations for DTLS 1.2 virtual servers that reference a Server SSL profile with a certificate, key, and SSL Sign Hash set to ANY.
• Correlate TMM crash events with inbound DTLS traffic patterns and source IPs to identify potential exploitation attempts.
• Use F5 iHealth diagnostics to scan qkviews for known signatures associated with this advisory.

Monitoring Recommendations

• Forward /var/log/ltm, /var/log/tmm, and audit logs to a centralized SIEM and alert on repeated TMM restarts.
• Monitor virtual server availability and connection drop counters for DTLS-enabled services.
• Track outbound mutual TLS/DTLS authentication failures with backend pool members as a potential precursor to the crash condition.

How to Mitigate CVE-2025-61951

Immediate Actions Required

• Identify all DTLS 1.2 virtual servers attached to Server SSL profiles where the certificate, key, and SSL Sign Hash = ANY are configured against backends requiring client authentication.
• Apply the engineering hotfix or upgraded software version published in F5 Security Advisory K000151309.
• Inventory BIG-IP systems that have reached End of Technical Support and plan migration, since F5 does not evaluate EoTS versions for this CVE.

Patch Information

F5 has published remediation guidance in Security Advisory K000151309, which lists fixed versions across BIG-IP modules including LTM, APM, AFM, ASM, Advanced WAF, SSL Orchestrator, DNS, and others up to 17.5.0. Administrators should consult the advisory to map their installed version to the appropriate fixed release.

Workarounds

• Change the SSL Sign Hash value on affected Server SSL profiles from ANY to a specific algorithm such as SHA256, SHA384, or SHA512.
• Disable DTLS 1.2 on the virtual server if mutual authentication with the backend is not strictly required.
• Restrict network access to affected DTLS virtual servers using upstream access control lists until patching is complete.

# Configuration example: replace SSL Sign Hash ANY with a specific hash via tmsh
tmsh modify ltm profile server-ssl <profile_name> ssl-sign-hash sha256
tmsh save sys config