F5 BIG-IP CVE-2025-58071

Exploitation requires that IPsec is configured on the BIG-IP system - this is the explicit precondition named in the description, and systems without IPsec configured are not exposed. When IPsec is configured, the attack is remote and unauthenticated against the traffic path (AV:N/PR:N/UI:N per CVSS 4.0), requiring no special privileges or user interaction. Additional limiting factors: software versions that have reached End of Technical Support (EoTS) were not evaluated, so exposure determination on such versions is unverified; impact is limited to availability (TMM termination / traffic disruption) with no data compromise.

This is a remote, unauthenticated denial-of-service affecting F5 BIG-IP, and the signals are internally consistent on that point: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, no-privilege, no-interaction attack, while the impact metrics (VC:N/VI:N/VA:H) confirm the effect is purely availability loss - a TMM crash - with no confidentiality or integrity impact. The 8.7 score is therefore driven entirely by easy reachability plus a high-availability hit, not by data compromise. Priority should be moderated by real-world signals: EPSS is low at 0.37% (29th percentile), the CVE is NOT on CISA KEV, and no public exploit was identified, indicating no evidence of active or imminent widespread exploitation. The single most important risk reducer is configuration-dependence: the flaw is only reachable when IPsec is configured on the system, so environments not running IPsec are not exposed regardless of the network-facing CVSS vector. CONFLICT TO NOTE: the input 'Information Disclosure' tag contradicts the CVSS vector (VC:N - no confidentiality impact) and the CWE-457/TMM-termination description, which describe a crash/DoS, not disclosure - treat this as availability-only and verify against F5 advisory K000156746.

An attacker with network reachability to an IPsec-configured BIG-IP sends undisclosed/crafted traffic that triggers use of an uninitialized variable (CWE-457) in the Traffic Management Microkernel, causing TMM to terminate and interrupting all traffic processing on the appliance. No authentication or user interaction is required (PR:N/UI:N), but the system must have IPsec enabled for the traffic path to be reachable. No public exploit code was identified at time of analysis.