High · published October 15, 2025
⚡ A non-default setting is the slippery slope here! When configured to Software-only, the tm.tcpudptxchecksum variable on a BIG-IP system can lead to a Traffic Management Microkernel (TMM) crash.🚨 Think of this as a traffic light that only works part-time; without the proper settings, the entire traffic flow can come to a halt, causing chaos on the road! If an attacker triggers this condition, it could result in service interruptions that knock your traffic management off course—leading to unavailable services and a frustrating experience for users. This could be particularly disastrous for mission-critical applications!
Think of this as a traffic light that only works part-time; without the proper settings, the entire traffic flow can come to a halt, causing chaos on the road! In this vulnerability, adjusting the tm.tcpudptxchecksum to a non-default Software-only value can expose the TMM to unhandled traffic, causing it to terminate unexpectedly.
If an attacker triggers this condition, it could result in service interruptions that knock your traffic management off course—leading to unavailable services and a frustrating experience for users. This could be particularly disastrous for mission-critical applications! To safeguard your systems, revert the tm.tcpudptxchecksum to its default setting immediately. Additionally, ensure your BIG-IP systems are updated to the latest supported version to avoid any unforeseen issues. You've got this! By following these steps, you'll keep your systems running smoothly and earn your security hero badge! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| f5/big-ip_access_policy_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_advanced_firewall_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_container_ingress_services | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_ddos_hybrid_defender | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_domain_name_system | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_edge_gateway | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_fraud_protection_service | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_global_traffic_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_link_controller | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_local_traffic_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_policy_enforcement_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_ssl_orchestrator | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_webaccelerator | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_websafe | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_advanced_web_application_firewall | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_analytics | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_acceleration_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_security_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_visibility_and_reporting | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_automation_toolchain | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_carrier-grade_nat | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_access_policy_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_advanced_firewall_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_advanced_web_application_firewall | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_analytics | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_application_acceleration_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_application_security_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_application_visibility_and_reporting | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_automation_toolchain | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_carrier-grade_nat | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_container_ingress_services | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_ddos_hybrid_defender | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_domain_name_system | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_edge_gateway | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_fraud_protection_service | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_global_traffic_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_link_controller | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_local_traffic_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_policy_enforcement_manager | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_ssl_orchestrator | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_webaccelerator | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_websafe | ≥ 16.1.0, < 16.1.6.1 | 16.1.6.1 |
| f5/big-ip_fraud_protection_service | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_fraud_protection_service | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_access_policy_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_access_policy_manager | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_advanced_firewall_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_advanced_firewall_manager | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_advanced_web_application_firewall | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_advanced_web_application_firewall | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_analytics | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_analytics | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_application_acceleration_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_application_acceleration_manager | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_application_security_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_application_security_manager | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_application_visibility_and_reporting | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_application_visibility_and_reporting | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_automation_toolchain | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_automation_toolchain | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_carrier-grade_nat | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_carrier-grade_nat | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_container_ingress_services | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_container_ingress_services | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_ddos_hybrid_defender | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_ddos_hybrid_defender | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_domain_name_system | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_domain_name_system | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_edge_gateway | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_edge_gateway | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_global_traffic_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_link_controller | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_link_controller | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_local_traffic_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_local_traffic_manager | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_policy_enforcement_manager | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_policy_enforcement_manager | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_ssl_orchestrator | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_ssl_orchestrator | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_webaccelerator | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_webaccelerator | ≥ 17.5.0, ≤ 17.5.1 | — |
| f5/big-ip_websafe | ≥ 17.1.0, < 17.1.3 | 17.1.3 |
| f5/big-ip_websafe | ≥ 17.5.0, ≤ 17.5.1 | — |