CVE-2025-59478CWE-824

CVE-2025-59478

High · published October 15, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

⚡ A crafty request can throw your BIG-IP AFM for a loop, causing the Traffic Management Microkernel (TMM) to crash! Think of this vulnerability like a competitor slipping an unregistered order into a busy restaurant, causing the kitchen to shut down while they sort out the chaos. If the TMM goes down, it’s like the restaurant losing track of all its tables, leaving everyone in the lurch! This denial-of-service vulnerability could halt traffic management processes, forcing your virtual server to crash. Imagine your website going offline just when you're about to capture those crucial customers! This means potential downtime and lost revenue for your operations.

Put simply

Think of this vulnerability like a competitor slipping an unregistered order into a busy restaurant, causing the kitchen to shut down while they sort out the chaos. If the TMM goes down, it’s like the restaurant losing track of all its tables, leaving everyone in the lurch! When the DoS protection profile is active, certain undisclosed requests can overwhelm the Traffic Management Microkernel, causing it to terminate unexpectedly. This disrupts service and affects the availability of your applications.

What to do

This denial-of-service vulnerability could halt traffic management processes, forcing your virtual server to crash. Imagine your website going offline just when you're about to capture those crucial customers! This means potential downtime and lost revenue for your operations. To secure your setup, ensure you update your BIG-IP AFM to a supported version immediately. Regularly audit your server configurations and analyze incoming requests to mitigate the risk of exposure. Don't forget to remove any unsupported versions that may still be in use! You've got this! By taking these steps, you’ll not only secure your system but also keep your services running smoothly! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00368 · 29.5th percentile
Weakness
CWE-824 · Access of Uninitialized Pointer
Published
2025-10-15T18:15Z
Affected products (3)
ProductVersionsFixed in
f5/big-ip_advanced_firewall_manager≥ 15.1.0, < 15.1.10.815.1.10.8
f5/big-ip_advanced_firewall_manager≥ 17.1.0, < 17.1.317.1.3
f5/big-ip_advanced_firewall_managerall versions—
References (1)
EPSS history
Timeline
  • 15 OCT 13:55Z
    BIG-IP AFM DoS protection profile vulnerability
    cvelistv5