BIG-IP SSL Orchestrator CVE-2025-41430

Exploitation requires that the BIG-IP SSL Orchestrator feature be enabled/configured on the device - the description explicitly scopes the flaw to 'When BIG-IP SSL Orchestrator is enabled.' Devices running BIG-IP without the SSL Orchestrator module provisioned are not affected by this path, which is the primary limiting factor. For affected configurations, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low attack complexity are needed - a network-reachable attacker can send the crafted traffic directly. Note that EoTS (End of Technical Support) software versions were not evaluated by the vendor, so risk on unsupported versions is indeterminate.

This is a denial-of-service vulnerability (CWE-770, uncontrolled resource consumption) in F5 BIG-IP SSL Orchestrator where undisclosed traffic crashes the Traffic Management Microkernel (TMM). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated trigger with no user interaction, and the impact is strictly availability (VA:H with VC:N/VI:N - no confidentiality or integrity loss, plus a minor subsequent-system availability effect SA:L). The signals are internally consistent and point to a real but bounded priority: easy to trigger remotely, but impact is limited to crashing/restarting the data-plane engine rather than code execution or data theft. EPSS is low at 0.35% (27th percentile), the CVE is NOT in CISA KEV, and no public exploit is identified, so there is no evidence of active or imminent widespread exploitation despite the high 8.7 base score. The elevated score is driven by the unauthenticated network DoS of a critical network device, not by exploitation likelihood. The key caveat is conditionality: exploitation requires that SSL Orchestrator be enabled, so the raw AV:N/PR:N vector overstates exposure for BIG-IP deployments that do not run this specific module.

A remote, unauthenticated attacker sends specially crafted (undisclosed) traffic to a BIG-IP device that has SSL Orchestrator enabled, causing the TMM data-plane process to terminate and disrupting all traffic processing on the appliance. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the trigger is low-complexity and needs no authentication or user interaction; repeated requests could sustain a denial of service. No public exploit code has been identified at time of analysis.