CVE-2025-61990

Executive Summary

CVE-2025-61990 is a high-severity (CVSS 7.5) vulnerability affecting F5 multi-bladed platforms. The flaw resides in the Traffic Management Microkernel (TMM), where undisclosed traffic can cause TMM to terminate. This results in a denial-of-service (DoS) condition, impacting availability of the affected F5 device. No patch is currently available, and the vendor has not released a security advisory. The vulnerability is not yet exploited in the wild (EPSS 0.0%), but given the critical role of F5 devices in network infrastructure, it poses a significant risk to organizations using multi-blade configurations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – TMM termination leads to service disruption.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it attractive for DoS attacks against critical network infrastructure.

Deep Dive & Mechanics

The vulnerability exists in the Traffic Management Microkernel (TMM) of F5 multi-bladed platforms. TMM is a critical component responsible for processing network traffic, including load balancing, SSL termination, and traffic steering. On multi-blade systems, TMM operates across multiple blades to distribute traffic.

The flaw is triggered by "undisclosed traffic" – likely a specific sequence of packets or malformed data that causes a memory corruption or logic error in TMM. When this traffic is received, TMM terminates unexpectedly, leading to a complete loss of traffic processing capabilities on the affected blade. In a multi-blade configuration, this could cascade, affecting overall system availability.

The root cause is likely a lack of input validation or improper handling of edge-case network packets. Since no patch is available, the exact mechanism remains undisclosed by F5.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code resides in the TMM binary, which is proprietary and not publicly accessible. Without a patch, no code comparison can be made.

Exploitation & Lab Setup

Red Team

Objective: Trigger TMM termination on a multi-blade F5 device.

Prerequisites:

• Access to a multi-blade F5 BIG-IP system (e.g., iSeries, VIPRION).
• Network connectivity to the management or data plane interface.

Steps:

1. Reconnaissance: Identify F5 multi-blade devices using Shodan dorks: "F5 BIG-IP multi-blade" or "TMM crash".
2. Craft Malicious Traffic: Since the exact payload is undisclosed, use fuzzing techniques to generate traffic that may trigger the vulnerability. Tools like Scapy or boofuzz can be used to send malformed packets.
3. Launch Attack: Send the crafted traffic to the target device's data plane interface.
4. Verify Impact: Monitor TMM status using tmsh show sys tmm-info or check for TMM restarts in logs.

Example Scapy script (conceptual):

from scapy.all import *
import random

target_ip = "192.168.1.100"
# Craft a malformed TCP packet
packet = IP(dst=target_ip)/TCP(dport=80, flags="S")/Raw(load="A"*1000)
send(packet, loop=1, inter=0.01)

Note: This is a generic example. Actual exploitation requires knowledge of the specific triggering condition.

Blue Team

Detection:

• Monitor for TMM crashes or restarts using F5 logs: /var/log/tmm or tmsh show sys log.
• Set up alerts for high-frequency TMM restarts.
• Use network monitoring to detect anomalous traffic patterns targeting F5 devices.

Mitigation:

• Implement network access controls to restrict traffic to F5 devices.
• Apply virtual patching via WAF or IPS rules if available.
• Isolate multi-blade systems from untrusted networks.

Indicators of Compromise (IOCs)

• Log Entries: TMM crash logs in /var/log/tmm containing "TMM terminated" or "core dump".
• System Events: Unexpected TMM restarts or failover events.
• Network Traffic: Unusual packet sequences targeting F5 data plane interfaces.
• File Hashes: Core dump files generated after TMM crash (e.g., /var/core/tmm.core).

Detection Engineering

YARA Rule

rule CVE_2025_61990_TMM_Crash {
    meta:
        description = "Detects TMM crash indicators from CVE-2025-61990"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61990"
    strings:
        $tmm_crash = "TMM terminated" nocase
        $core_dump = "core dump" nocase
        $tmm_error = "tmm: fatal error" nocase
    condition:
        any of them
}

Sigma Rule

title: F5 TMM Crash Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects TMM crash events on F5 devices
author: Valters IT
logsource:
    product: f5
    service: tmm
detection:
    selection:
        - EventID: "TMM_CRASH"
        - Message|contains: "TMM terminated"
        - Message|contains: "core dump"
    condition: selection
falsepositives:
    - Legitimate TMM restarts during maintenance
level: high

Suricata Rule

alert tcp any any -> $HOME_NET 80 (msg:"CVE-2025-61990 F5 TMM Crash Attempt"; flow:to_server; content:"|41 41 41|"; depth:1000; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule is a placeholder. Actual detection requires knowledge of the specific malicious payload.

Remediation & Mitigation

• Immediate: Apply network segmentation to limit exposure of F5 multi-blade devices.
• Workaround: Disable multi-blade functionality if not required, or use single-blade configurations.
• Monitor: Watch for F5 security advisories and apply patches when released.
• Virtual Patching: Use WAF/IPS rules to block suspicious traffic patterns.
• Backup: Ensure configuration backups are available for quick recovery.

Valters IT
DevSecOps & Cyber Threat Intelligence