CVE-2025-22891

published 2025-02-05

CVE-2025-22891: When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop…

high 8.7 CVSS 4.0

AV N AC L AT N PR N UI N VC N VI N VA H SC N SI N SA L E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
f5	big-ip	>= 15.1.0 < *	*
f5	big-ip	>= 16.1.0 < 16.1.5	16.1.5
f5	big-ip	>= 17.1.0 < 17.1.2	17.1.2
f5	big-ip_pem	—	—
f5	big-ip_policy_enforcement_manager	>= 15.1.0 < 15.1.10.6.0.11.6	15.1.10.6.0.11.6
f5	big-ip_policy_enforcement_manager	>= 16.1.0 < 16.1.5	16.1.5
f5	big-ip_policy_enforcement_manager	>= 17.1.0 < 17.1.2	17.1.2

CWE-772