BIG-IP Next CVE-2025-54805

Requires an iRule to be configured on a virtual server specifically via the declarative API, with the leak triggered upon re-instantiation during the TMM cleanup process - so an attacker needs authenticated low-privilege access (PR:L) to the declarative API to create and repeatedly re-instantiate iRule configurations. Limiting factors: the flaw only manifests on re-instantiation/cleanup (reflected as AT:P), impact is confined to gradual TMM memory growth with no data exposure, and software versions past End of Technical Support were not evaluated, so exposure is tied to supported BIG-IP Next CNF/Kubernetes/Service Proxy deployments running iRules through the declarative API.

This is a genuine but modest-priority issue, not a high-urgency flaw. The CVSS 4.0 base score of 6.0 (AV:N/AC:L/AT:P/PR:L/UI:N) reflects a memory leak (CWE-401) whose only real impact is availability: VC:N and VI:N confirm no confidentiality or integrity loss on the vulnerable system, while VA:H reflects that uncontrolled TMM memory growth can eventually exhaust resources and degrade the data plane. Critically, PR:L means the attacker must already be an authenticated/low-privileged operator able to configure iRules through the declarative API, and AT:P indicates a non-trivial attack requirement (the leak only manifests on re-instantiation/cleanup) - both of which sharply limit who can trigger this and how reliably. The EPSS score of 0.31% (22nd percentile) is low and consistent with this profile: no mass-exploitation pressure. The CVE is NOT in CISA KEV and no public exploit code was provided, so exploitation status is 'no public exploit identified at time of analysis.' All signals align rather than conflict: low EPSS, no KEV, no POC, availability-only impact, and a privileged/config-dependent trigger together place this well below internet-facing RCE or data-theft bugs in priority. One data caveat: the input Tags include 'Information Disclosure,' which contradicts the CVSS vector (VC:N) and the CWE (memory leak/resource exhaustion) - treat the info-disclosure label as erroneous.

An authenticated operator (or an attacker who has gained low-privilege access to the declarative API) configures an iRule on a virtual server and repeatedly re-instantiates the configuration; each cleanup cycle leaks TMM memory, and over many iterations the Traffic Management Microkernel consumes increasing memory until performance degrades or the data plane is disrupted. Because AT:P applies, the condition only occurs on re-instantiation, so exploitation is gradual rather than instantaneous. No public exploit code was identified at the time of analysis.