BIG-IP Next CVE-2025-60016

Exploitation requires that DH ECC Brainpool curves be configured in an SSL profile's Cipher Rule or Cipher Group AND that this profile be applied to a virtual server on BIG-IP Next Cloud-Native Network Functions or Service Proxy for Kubernetes; this is a non-default cipher configuration, so instances using default or non-Brainpool cipher settings are not affected. Once that configuration exists, the per the CVSS vector no authentication (PR:N) or user interaction (UI:N) is needed and the trigger is network-reachable. The primary limiting factor is the specific Brainpool curve configuration; a secondary limitation is that End-of-Technical-Support software versions were not evaluated, so coverage for EoTS versions is undetermined.

This is a denial-of-service vulnerability, not a code-execution or data-exposure flaw: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows network-reachable, low-complexity, unauthenticated triggering, but the impact metrics confirm availability-only harm (VC:N/VI:N/VA:H) with no confidentiality or integrity impact and no subsequent-system scope change. The CWE-119 classification (memory buffer error) combined with the description - undisclosed traffic causing the Traffic Management Microkernel (TMM) to terminate - indicates a crash/restart condition rather than exploitable memory corruption for RCE. Real-world risk is moderated heavily by a configuration precondition: the flaw is only reachable when DH ECC Brainpool curves are explicitly configured in an SSL profile's Cipher Rule or Cipher Group and that profile is bound to a virtual server, which is a non-default, operator-chosen cipher setting. Supporting signals are consistent and low-urgency: EPSS is 0.44% (37th percentile), there is no CISA KEV listing, and no public POC is referenced - so this is 'no public exploit identified at time of analysis.' The 8.7 score is driven almost entirely by the high availability impact of an unauthenticated network trigger; absent the specific Brainpool configuration this is not exploitable, making it a genuine-but-conditional DoS priority rather than a widespread drop-everything issue. No signals conflict; the main caveat is that the exact triggering traffic is 'undisclosed' by F5, so independent verification of the trigger is not possible from the provided data.

An attacker who can send TLS traffic to a virtual server whose SSL profile is configured with ECC Brainpool curves sends crafted/undisclosed handshake traffic that triggers a memory-handling fault in TMM, causing the microkernel to terminate. Because TMM is the core traffic-processing engine, its termination drops processing for the affected data plane, producing a denial of service; no authentication or user interaction is required (PR:N/UI:N). No public exploit code is identified at time of analysis.