BIG-IP PEM CVE-2025-54479

Exploitation requires that a classification profile be configured on a virtual server that does NOT also have an HTTP or HTTP/2 profile attached - this specific, non-default profile combination is the mandatory prerequisite named in the F5 description. Affected products are limited to BIG-IP Policy Enforcement Manager, BIG-IP Next Cloud-Native Network Functions (2.0.0-2.1.0), and BIG-IP Next for Kubernetes (2.0.0, 2.1.0); End-of-Technical-Support versions are not evaluated. The attacker must be able to send requests to that virtual server (AV:N/PR:N/UI:N - no authentication or user interaction indicated by the vector). Limiting factors: virtual servers that include an HTTP/HTTP2 profile, or that do not use a classification profile, are not affected, which sharply reduces real-world exposure.

Signals are consistent and point to a genuine but bounded denial-of-service issue rather than a top-tier crisis. The F5-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated trigger, but the impact metrics show availability-only harm (VA:H with VC:N/VI:N/VA:H and no confidentiality or integrity impact), i.e. TMM termination/DoS - NOT remote code execution, despite the 'Buffer Overflow' and 'Memory Corruption' tags and CWE-787 (out-of-bounds write) classification. The 8.7 score is driven entirely by the high availability impact plus network reachability. EPSS is low at 0.35% (27th percentile), which aligns with the absence of any KEV listing or public POC and suggests no observed mass exploitation. Critically, exploitation is gated by a non-default deployment condition (a classification profile on a virtual server that lacks an HTTP or HTTP/2 profile), which materially narrows the exposed population below what the PR:N/AC:L vector alone implies - verify your virtual-server configuration before treating this as broadly exploitable. Net: a real patch-worthy availability risk for affected configurations, but not an emergency; the high CVSS overstates urgency for environments not running the specific profile combination.

An attacker who can reach an affected F5 virtual server that is configured with a classification profile but no HTTP/HTTP2 profile sends specially crafted (undisclosed) requests to that listener. Processing the request triggers an out-of-bounds write in TMM, causing the Traffic Management Microkernel to terminate and interrupting all traffic it handles. No public exploit code is identified at time of analysis, and the attack yields denial of service only, not code execution or data access.