BIG-IP Next CVE-2025-58120

Exploitation requires the target BIG-IP Next instance to have HTTP/2 Ingress configured - this is the explicit prerequisite stated in the description ('When HTTP/2 Ingress is configured'). Within that configuration, no authentication, user interaction, or local access is needed (AV:N/PR:N/UI:N), so any network-reachable attacker can send the triggering HTTP/2 traffic. Limiting factors: deployments not using HTTP/2 Ingress are not affected; only the listed BIG-IP Next products (Service Proxy for Kubernetes, Cloud-Native Network Functions, BIG-IP Next for Kubernetes) are in scope; and software versions past End of Technical Support were not evaluated. Impact is limited to availability (TMM termination / DoS) - no data exposure or modification.

This is a genuine but conditional denial-of-service risk rather than a code-execution emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation, and the only impact metric set is VA:H (availability high) with VC:N/VI:N - consistent with the CWE-476 null-pointer dereference crashing the Traffic Management Microkernel (TMM), i.e. a service outage with no confidentiality or integrity impact. The 8.7 score is driven entirely by availability on a core traffic-processing component. Counter-signals temper urgency: EPSS is only 0.35% (27th percentile), indicating low modeled near-term exploitation probability, and there is no CISA KEV listing and no public exploit identified at time of analysis. No SSVC decision record is present in the input. The key limiting factor is that exploitation requires HTTP/2 Ingress to be configured, so environments not using HTTP/2 Ingress are not exposed. Net: a real priority for operators running the affected BIG-IP Next Kubernetes/CNF products with HTTP/2 Ingress - because an unauthenticated remote attacker can crash TMM and disrupt traffic - but not a widespread mass-exploitation threat given low EPSS, no KEV, and no known POC. Note the input provides only a CVSS 4.0 vector; no CVSS 3.1 vector was supplied for cross-check.

An unauthenticated remote attacker sends specially crafted (undisclosed) HTTP/2 traffic to a BIG-IP Next instance configured with HTTP/2 Ingress, triggering a null-pointer dereference that terminates the TMM process and interrupts all traffic it handles. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is needed. No public exploit code is identified at time of analysis, so an attacker would need to independently discover the triggering traffic pattern.