F5 BIG-IP CVE-2025-58096
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach BIG-IP data plane over network
-
ExploitSend crafted TCP/UDP traffic
-
ExecutionTrigger TMM processing fault on Software-only checksum path
-
ImpactTMM terminates, traffic interrupted (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the BIG-IP database variable tm.tcpudptxchecksum to be set to the non-default value 'Software-only' - the vulnerability does NOT affect default configurations. When that setting is active, a remote unauthenticated attacker (CVSS PR:N) can send undisclosed crafted TCP/UDP traffic to cause TMM termination. Limiting factors: the non-default checksum configuration is a hard prerequisite (captured as AT:P in the CVSS 4.0 vector), and software versions that have reached End of Technical Support (EoTS) were not evaluated, so applicability depends on running an in-support version with this specific setting. |
| Impact | This is a denial-of-service vulnerability (CWE-787 / memory corruption per tags) in F5 BIG-IP Traffic Management Microkernel (TMM) whose real-world risk is substantially gated by a non-default configuration precondition. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2 (High) and reflects a network, unauthenticated attack with availability-only impact - but critically it carries AT:P (attack requirements present), which encodes that exploitation only works when the database variable tm.tcpudptxchecksum is set to the non-default value 'Software-only.' Signals are consistent but point to low-to-moderate practical priority: EPSS is only 0.35% (26th percentile), there is NO CISA KEV listing and NO public POC, so the status is 'no public exploit identified at time of analysis.' The high CVSS is driven entirely by VA:H (TMM crash/traffic interruption), with no confidentiality or integrity impact. Note a signal to verify: tags label this 'Buffer Overflow / Memory Corruption' and CWE-787 is out-of-bounds write, which could imply code-execution potential, yet the F5 vector explicitly sets VC:N/VI:N and only VA:H - impact is confined to TMM termination (DoS), not RCE; treat any memory-corruption-to-RCE assumption as unconfirmed by available data. Net: a genuine DoS risk for the subset of deployments using the non-default Software-only checksum setting, but a high-CVSS-but-conditional issue for the majority running defaults. |
| Exploit ScenarioDerived | An organization has configured BIG-IP with tm.tcpudptxchecksum set to the non-default 'Software-only' value. A remote, unauthenticated attacker sends specially crafted (undisclosed) TCP/UDP traffic to the BIG-IP data plane, causing TMM to terminate and interrupting all traffic processing until it restarts. No public exploit code is identified at time of analysis, and exploitation requires the specific non-default configuration to be present. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Denial of service in F5 BIG-IP's Traffic Management Microkernel (TMM) lets a remote, unauthenticated attacker crash the traffic-processing core by sending undisclosed crafted TCP/UDP traffic, but only on systems where the database variable tm.tcpudptxchecksum has been set to the non-default value 'Software-only'; default configurations are not affected. The root cause is a memory-corruption class defect (CWE-787, out-of-bounds write) in TMM's software checksum handling, rated 8.2 under the vendor's CVSS 4.0 vector, while independent assessment with CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) places it lower because the non-default checksum setting is a hard prerequisite (captured as AT:P in the 4.0 vector). EPSS is low (0.35%, 26th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV. Because TMM is shared across virtually every BIG-IP module, an affected appliance loses its data-plane forwarding capability each time TMM terminates.
RemediationAI
The primary fix is to upgrade to the patched BIG-IP release listed for your branch in the F5 advisory at https://my.f5.com/manage/s/article/K000156691 - that advisory is the authoritative source for the exact fixed version numbers, which are not enumerated in the intelligence provided here, and no vendor fix version is confirmed in the available data. Until a maintenance window is available, the most effective compensating control is to revert tm.tcpudptxchecksum from 'Software-only' to its default value (configured via tmsh, for example modifying the sys db tm.tcpudptxchecksum entry); this removes the vulnerable code path entirely and is low risk, though it changes checksum offload behavior and could slightly increase CPU load or alter throughput characteristics on traffic-heavy appliances, so benchmark after the change. Operators who cannot alter the setting should tightly restrict exposure in front of the affected virtual servers - allow only trusted source ranges and expected protocols through network or iRule/ACL filtering - recognizing that this is only a partial mitigation because the crash is triggered by plausibly-formed TCP/UDP traffic that may not be distinguishable from legitimate sessions. Additionally, monitor TMM restarts and core dumps (via /var/log, tm.minor or tmm logs, and SNMP traps) as a detection signal, and note that deploying an in-support BIG-IP version is required because End of Technical Support releases were not evaluated and may remain exposed. No public exploit code is known at this time and EPSS is low, so prioritization can follow the configuration prerequisite, but internet-facing appliances with the non-default setting should be treated as high priority given the 8.2 CVSS 4.0 rating and the availability-only (no confidentiality or integrity) impact profile.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TMM (Traffic Management Microkernel) is the user-space process on BIG-IP that handles all data-plane functions - virtual servers, pools, TCP/UDP proxying, SSL and full-proxy traffic processing - so any crash of TMM interrupts the load balancer's ability to pass traffic. The database variable tm.tcpudptxchecksum controls how TCP and UDP checksum generation and verification are handled, allowing operators to force checksum processing into hardware or, with the non-default 'Software-only' setting, into TMM's software code path. In that configuration, crafted traffic drives TMM into an out-of-bounds write (CWE-787), a memory-corruption condition that terminates the process. The affected CPE list spans the full BIG-IP module family - Access Policy Manager, Advanced Firewall Manager, Advanced Web Application Firewall, Analytics, Application Acceleration Manager, Application Security Manager, Application Visibility and Reporting, Automation Toolchain, Carrier-Grade NAT, and Container Ingress Services, plus other modules per the advisory - because they all rely on the same TMM data plane rather than because each module contains an independent defect. Note that BIG-IP software versions that have reached End of Technical Support were not evaluated and may be vulnerable but are outside the advisory's scope.
Know when Big Ip Advanced Web Application Firewall gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable and unauthenticated (AV:N/PR:N), but the required non-default Software-only checksum setting is a condition beyond attacker control, so AC:H; impact is TMM crash only, hence C:N/I:N/A:H.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
DescriptionCVE.org
When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
F5 BIG-IP appliances that have configured the tm.tcpudptxchecksum database variable to the non-default 'Software-only' value face a remote, unauthenticated denial-of-service condition in the Traffic Management Microkernel (TMM) tracked as CVE-2025-58096. A crash of TMM can interrupt data-plane forwarding across BIG-IP modules, potentially disrupting applications and network services that depend on the affected appliance. No public exploit has been identified at time of analysis and the issue is not in CISA KEV, but no vendor-released patch is currently available, making configuration validation and outage contingency planning the immediate priority.
No vendor-released patch identified at time of analysis; interim mitigations include verifying and, where operationally feasible, reverting tm.tcpudptxchecksum from 'Software-only' to its default setting, limiting network exposure to trusted sources, monitoring TMM for crashes or restarts, and engaging F5 support for additional guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Affected Products (CPE)CVE.org
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious tra
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authe
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BI
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated
BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdow
A directory traversal vulnerability exists in the BIG-IP Configuration Utility that may allow an authenticated attacker
On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x
GitHub PoC
Exploit-DB