F5 BIG-IP APM Access Profile Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in F5 BIG-IP systems when the Access Policy Manager (APM) Access Profile is enabled on a virtual server. Undisclosed requests can lead to the termination of the Traffic Management Microkernel (TMM) process, causing a disruption as TMM restarts. This issue allows remote, unauthenticated attackers to disrupt traffic on the BIG-IP system.

Impact

Exploitation of this vulnerability causes a denial-of-service condition on the BIG-IP system by disrupting traffic management processes, which are temporarily halted until the process restarts.

Remediation

Users can upgrade to BIG-IP versions 17.1.2, 16.1.5, or consult the F5 BIG-IP hotfix and point release matrix for guidance. For more information about managing BIG-IP product hotfixes, refer to the F5 article K13123.