CVE-2025-24497: BIG-IP PEM vulnerability
When URL categorization is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.
Other sources
When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24497?
CVE-2025-24497 is classified as a severe vulnerability due to the potential for the Traffic Management Microkernel to terminate unexpectedly.
How do I fix CVE-2025-24497?
To mitigate CVE-2025-24497, you should upgrade F5 BIG-IP (PEM) to the latest version that addresses this vulnerability.
Which versions of F5 BIG-IP (PEM) are affected by CVE-2025-24497?
F5 BIG-IP (PEM) versions 17.1.0 to 17.1.2 are affected by CVE-2025-24497.
What impact does CVE-2025-24497 have on F5 BIG-IP (PEM) systems?
CVE-2025-24497 can lead to the termination of the Traffic Management Microkernel, causing disruptions in traffic management services.
Is URL categorization related to CVE-2025-24497?
Yes, URL categorization is a configuration setting on the virtual server that, when improperly configured, can trigger the vulnerability CVE-2025-24497.