Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
Back to vulnerabilities
High

Denial of Service in F5 BIG-IP / BIG-IP Next TMM with MPTCP Enabled

IdentifiersCVE-2025-48008CWE-400

CVE-2025-48008 is a denial-of-service vulnerability affecting F5 products that use the Traffic Management Microkernel (TMM). According to the provided content, when a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic, together with additional conditions beyond the attacker's control, can cause TMM to terminate. The vulnerable condition is tied to processing of traffic by a virtual server using a TCP profile with MPTCP enabled. No further technical details about the specific code path or function were provided in the source content.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial
ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause the Traffic Management Microkernel (TMM) to terminate, resulting in denial of service for traffic handled by the affected system. Depending on deployment architecture and failover behavior, this may interrupt application delivery and availability for services fronted by the affected virtual server or device.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by disabling MPTCP on TCP profiles associated with virtual servers where it is not strictly required, or by removing affected virtual servers from exposure until fixes can be applied. More generally, follow F5's published workaround and mitigation guidance in the relevant advisory. Because exploitation also depends on additional undisclosed conditions beyond the attacker's control, no complete compensating control is described in the provided content beyond avoiding the vulnerable configuration and applying vendor fixes.

Remediation

Patch, then assume compromise.

Upgrade to an F5-fixed software version or apply the relevant engineering hotfix referenced in F5 advisory k000156572 and the product-specific CVE guidance. Because the provided content does not include exact fixed version numbers, the authoritative remediation is to consult the corresponding F5 security advisory for CVE-2025-48008 and update affected BIG-IP, BIG-IP Next, F5OS, or related components as applicable. Software versions that have reached End of Technical Support are not evaluated and should be upgraded to supported releases.
PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
F5Big-Ip Access Policy Managerapplication
F5Big-Ip Advanced Firewall Managerapplication
F5Big-Ip Advanced Web Application Firewallapplication
F5Big-Ip Analyticsapplication
F5Big-Ip Application Acceleration Managerapplication
F5Big-Ip Application Security Managerapplication
F5Big-Ip Application Visibility And Reportingapplication
F5Big-Ip Automation Toolchainapplication
F5Big-Ip Carrier-Grade Natapplication
F5Big-Ip Container Ingress Servicesapplication
F5Big-Ip Ddos Hybrid Defenderapplication
F5Big-Ip Domain Name Systemapplication
F5Big-Ip Edge Gatewayapplication
F5Big-Ip Fraud Protection Serviceapplication
F5Big-Ip Global Traffic Managerapplication
F5Big-Ip Link Controllerapplication
F5Big-Ip Local Traffic Managerapplication
F5Big-Ip Next Cloud-Native Network Functionsapplication
F5Big-Ip Next Service Proxy For Kubernetesapplication
F5Big-Ip Policy Enforcement Managerapplication
F5Big-Ip Ssl Orchestratorapplication
F5Big-Ip Webacceleratorapplication
F5Big-Ip Websafeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Start free trial
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES
MITRE CVE
cve.org · CVE-2025-48008
NVD
nvd.nist.gov/vuln/detail/CVE-2025-48008
MITRE CWE · CWE-400
cwe.mitre.org
Vendor Advisory
my.f5.com/manage/s/article/K000150614