Network-reachable SIP profile traffic can terminate TMM in F5 BIG-IP

When a SIP profile is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

F5 BIG-IP, covering All Modules when a SIP profile is configured on a virtual server, is recorded as affected in these branches:

• 21.0.0 through before 21.0.0.2.
• 17.5.0 through before 17.5.1.6.
• 17.1.0 through before 17.1.3.2.
• The 16.1.0 branch with an upper boundary of * in the supplied affected data, meaning that no safe upper boundary or specific fixed release is provided for this branch.

NVD lists 21.1.0 as unaffected. That entry should not be used to infer the status of parallel branches or other unverified versions. Software that has reached End of Technical Support (EoTS) is outside F5's evaluation scope.

The flaw occurs when a SIP profile is configured on a virtual server and the device receives undisclosed traffic. That traffic can cause the Traffic Management Microkernel (TMM) to terminate. The record maps the issue to CWE-770, Allocation of Resources Without Limits or Throttling, but does not disclose the resource-handling path or the specific conditions in the SIP traffic that trigger the failure. The supplied attack characteristics describe network reachability with no authentication privilege or user interaction required and low attack complexity. The exploit payload, SIP message format, and precise TMM code path are not disclosed.

• Reachability: Network reachable; the supplied record indicates that no privileges or user interaction are required.
• Precondition: A SIP profile must be configured on a virtual server.
• Exploitation status: The record marks public exploit as false; known_exploited is not established. The GCVE record returned during research includes a CISA ADP enrichment marked Exploitation: none, but that is a point-in-time status and does not prove that exploitation is impossible.
• No exploit payload, traffic pattern, or specific indicator of compromise has been disclosed.

Network traffic received under the condition that a SIP profile is configured on a virtual server can terminate TMM, causing loss of traffic processing and denial of service. The record describes an attack path that requires no authentication privilege and no user interaction, but it does not indicate privilege escalation, impact to another security authority, or effects on confidentiality and integrity. Whether HA or failover limits the outage depends on the deployment architecture and is not established. The specific traffic that triggers the failure has not been disclosed.

• Remote unauthenticated traffic may cause TMM to terminate, potentially interrupting traffic processing and service availability on the affected BIG-IP system.
• The primary consequence is denial of service; the record does not indicate data disclosure, data modification, or privilege compromise.
• The operational duration and recovery behavior depend on the deployment's HA and recovery configuration, which are not established by the available evidence.
• Systems exposing SIP services through virtual servers should be prioritized for inventory and upgrade review.

1. Upgrade each affected branch to its identified fixed boundary release: 21.0.0.2 for the 21.0.0 branch, 17.5.1.6 for the 17.5.0 branch, and 17.1.3.2 for the 17.1.0 branch.
2. For the 16.1.0 branch, the available affected data does not identify a fixed release. Treat this branch as unresolved and obtain an F5-supported upgrade path; do not assume that another 16.1.x release is safe.
3. After upgrading, verify the actual installed version on every device and review virtual server objects that use a SIP profile.
4. Confirm the EoTS status before planning remediation because F5 does not evaluate unsupported software versions.
5. The record does not provide a separate mitigation. Do not treat self-created filtering rules or SIP configuration changes as confirmed mitigations without applicable F5 guidance.

1. Inventory all F5 BIG-IP systems and record the exact running branch, including systems with multiple modules.
2. Review configuration inventories for virtual server objects using a SIP profile; this is the disclosed exposure condition.
3. Compare each installed version with the affected boundaries: 21.0.0 before 21.0.0.2, 17.5.0 before 17.5.1.6, 17.1.0 before 17.1.3.2, and the 16.1.0 branch for which no safe upper boundary is supplied.
4. Check the product support lifecycle because F5 does not evaluate software versions that have reached End of Technical Support (EoTS).
5. Review existing monitoring for TMM termination or restart events near inbound SIP traffic. This is precautionary monitoring, not a confirmed indicator; the absence of an alert does not prove that a system is safe.