#VU103723 Improper resource shutdown or release in BIG-IP and BIG-IP Next SPK - CVE-2025-22846

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU103723

#VU103723 Improper resource shutdown or release in BIG-IP and BIG-IP Next SPK - CVE-2025-22846

Published: February 7, 2025


Vulnerability identifier: #VU103723
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2025-22846
CWE-ID: CWE-404
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
BIG-IP
BIG-IP Next SPK
Software vendor:
F5 Networks

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources when the Session Initiation Protocol (SIP) application layer gateway (ALG) profile and the SIP router ALG profile are configured on a Message Routing type virtual server. A remote attacker can send specially crafted packets to the device and perform a denial of service (DoS) attack.


Remediation

Install updates from vendor's website.

External links