F5 BIG-IP CVE-2025-61951

Exploitation requires a very specific, non-default configuration: a DTLS 1.2 virtual server must be enabled with a Server SSL profile that has a certificate and key configured and the SSL Sign Hash set to ANY, AND the backend server must be configured for DTLS 1.2 with client authentication. Devices without a DTLS 1.2 virtual server, or with a different SSL Sign Hash setting, or without backend client authentication, are not affected. Additionally, software versions past End of Technical Support (EoTS) were not evaluated and are out of scope. No authentication is required against a vulnerable configuration (PR:N), and no user interaction is needed (UI:N); the primary limiting factor is the narrow configuration prerequisite rather than access control.

This is a denial-of-service vulnerability in F5 BIG-IP's Traffic Management Microkernel (TMM), the core data-plane process whose termination disrupts all traffic handling on the device. The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:N/VI:N/VA:H) frames it as a network-reachable, unauthenticated availability-only impact - no confidentiality or integrity loss - which is consistent with the description of TMM terminating on undisclosed traffic. However, the real-world risk is substantially gated by configuration: exploitation only applies when a DTLS 1.2 virtual server is paired with a specific Server SSL profile (certificate, key, SSL Sign Hash set to ANY) and a backend configured for DTLS 1.2 with client authentication. This is a non-default, relatively uncommon deployment, so the vendor's AC:L arguably understates the practical attack complexity. The signals otherwise point to low urgency: EPSS is only 0.24% (14th percentile), the CVE is NOT in CISA KEV, and no public exploit code has been identified. There is no evidence of active exploitation. Net assessment: a genuine high-severity DoS for the narrow set of organizations running the exact affected DTLS configuration, but a low-priority, config-dependent issue for the broader BIG-IP fleet. Note one data inconsistency: the input Tags list 'Information Disclosure', yet CVSS VC:N and the description (TMM termination) indicate a pure availability impact, not disclosure - the tag appears mislabeled.

An attacker who can reach a BIG-IP virtual server configured for DTLS 1.2 (with the specific Server SSL profile and backend client-authentication setup described) sends specially crafted DTLS traffic. The malformed traffic triggers an out-of-bounds read (CWE-125) that terminates the TMM process, dropping all traffic processed by the device until it restarts. No public exploit code is known, and the network attack vector (AV:N/PR:N) means no authentication is required against a vulnerable configuration.