Denial of Service Vulnerability in F5 BIG-IP PEM Control Plane
CVE-2025-22891

8.7HIGH

Key Information:

Vendor

F5
Status
Big-ip
Vendor
CVE Published:
5 February 2025

What is CVE-2025-22891?

A denial of service vulnerability exists in the F5 BIG-IP PEM Control Plane when the listener Virtual Server is configured with a Diameter Endpoint profile. Malicious or unexpected traffic can lead to the Virtual Server ceasing to process new client connections, which may result in an increase in memory usage and potential service disruption. The issue primarily affects versions that have not reached End of Technical Support (EoTS).

Affected Version(s)

BIG-IP 17.1.0 < 17.1.2

BIG-IP 16.1.0 < 16.1.5

BIG-IP 15.1.0

References

https://my.f5.com/manage/s/article/K000139778
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5
.
CVE-2025-22891 : Denial of Service Vulnerability in F5 BIG-IP PEM Control Plane