Denial of Service Vulnerability in BIG-IP APM by F5 Networks

CVE-2021-22985

What is CVE-2021-22985?

The BIG-IP APM by F5 Networks is susceptible to a Denial of Service (DoS) condition. In versions prior to 16.0.1.1 of BIG-IP APM, under specific circumstances while managing VPN traffic, the Traffic Management Microkernel (TMM) may experience excessive memory consumption. This issue allows an authenticated malicious VPN user to exploit the vulnerability, potentially leading to a DoS attack on the Application Policy Manager (APM). It's important to note that software versions that have reached End of Software Development (EoSD) are not subject to this evaluation.

References