F5 BIG-IP CVE-2025-61990

Exploitation requires that the BIG-IP system runs on a multi-bladed chassis platform with more than one blade active (e.g., VIPRION/chassis-class hardware with multiple blades) - single-blade or standard appliance deployments are not stated to be affected and this is the primary limiting factor. Within that deployment, triggering is remote and unauthenticated (AV:N/PR:N/UI:N) via 'undisclosed' network traffic, so no credentials or user interaction are needed once the multi-blade precondition is met. Software versions that have reached End of Technical Support were not evaluated, so exposure cannot be assumed or ruled out for those builds.

This is a denial-of-service vulnerability (CWE-415 double free) that terminates the Traffic Management Microkernel (TMM), the data-plane core of F5 BIG-IP. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes low-complexity, remote, unauthenticated triggering with high availability impact only (VA:H) and no confidentiality or integrity impact (VC:N/VI:N) - consistent with a crash/DoS rather than data theft or code execution. Signals point toward moderate real-world priority rather than emergency: the CVSS 4.0 base score is 8.7 (high), but EPSS is only 0.35% (27th percentile), the CVE is NOT on CISA KEV, and no public exploit is referenced. These lower-urgency signals align with the narrow exploitation condition (the vulnerable code path only exists on multi-bladed chassis platforms with more than one blade), so the effective exposed population is a subset of all BIG-IP deployments. CONFLICTING SIGNAL: the input Tags label this 'Information Disclosure,' but the CVSS vector (VC:N, VI:N, VA:H), the CWE (double free), and the description (TMM termination) all indicate this is an availability/DoS issue, not disclosure - treat the 'Information Disclosure' label as incorrect. Net: a credible high-severity availability risk for organizations running multi-bladed F5 chassis, but not evidence of widespread or active exploitation at time of analysis.

A remote, unauthenticated attacker sends crafted or malformed network traffic to a BIG-IP system deployed on a multi-bladed chassis platform (more than one blade active). The traffic triggers a double-free condition in TMM, causing the microkernel to terminate and disrupting all traffic processing/failover on the affected device. No public exploit code is identified at time of analysis, and authentication requirements are unauthenticated per the PR:N vector.