CVE-2025-48008
Full vulnerability record from the local CVENow database.
Description
When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2025-10-15 14:15:48.003000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-48008",
"sourceIdentifier": "[email protected]",
"published": "2025-10-15T14:15:48.003",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
},
{
"lang": "es",
"value": "Cuando un perfil TCP con Multipath TCP (MPTCP) habilitado está configurado en un servidor virtual, el tráfico no revelado junto con condiciones fuera del control del atacante pueden causar que el Microkernel de Gestión de Tráfico (TMM) finalice. Nota: Las versiones de software que han alcanzado el Fin de Soporte Técnico (EoTS) no se evalúan."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "F5",
"product": "BIG-IP",
"defaultStatus": "unknown",
"modules": [
"All Modules"
],
"versions": [
{
"version": "17.5.0",
"lessThan": "*",
"versionType": "custom",
"status": "unaffected"
},
{
"version": "17.1.0",
"lessThan": "17.1.2.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "16.1.0",
"lessThan": "16.1.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "15.1.0",
"lessThan": "15.1.10.8",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "F5",
"product": "BIG-IP Next SPK",
"defaultStatus": "unknown",
"versions": [
{
"version": "2.0.0",
"lessThan": "*",
"versionType": "custom",
"status": "unaffected"
},
{
"version": "1.7.0",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "F5",
"product": "BIG-IP Next CNF",
"defaultStatus": "unknown",
"versions": [
{
"version": "2.0.0",
"lessThan": "*",
"versionType": "custom",
"status": "unaffected"
},
{
"version": "1.1.0",
"lessThan": "*",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-16T03:56:28.818003Z",
"id": "CVE-2025-48008",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.1.0",
"versionEndIncluding": "1.4.1",
"matchCriteriaId": "3222CE1A-3C23-40FC-9331-370F6BA1CDCC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:*",
"versionStartIncluding": "1.7.0",
"versionEndIncluding": "1.9.2",
"matchCriteriaId": "4C7328B4-B7E0-460E-8270-116FE813FB23"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "A7A0C1CA-EDEF-463F-B7C8-8B9E67239FC1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "6538FBFE-AE3F-41DC-BE48-8A2444DE1F39"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "8CDAF78A-6C2B-4640-93DD-524A0D9D80CE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "4BEC05AA-EB63-4A34-94E8-81606329BA75"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "F3007970-0661-4CAC-91A6-363396ED3B41"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "2450DC77-B46C-4886-AC9A-CF78B1EC4F06"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "D8BC9B56-DC91-4312-9A37-0892E1DCC97D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "B5C25C2C-608A-432F-B49C-CED71150801C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "96D77245-3641-49B9-BC32-472D460E5C1F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "37AF1DFD-AE86-4F64-9941-75FAA0186ED8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "87D1615C-6A97-4530-8E3A-92141B6EECD8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "787649F6-17ED-4EFE-9C48-8318FEB941E7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "268F789C-AC21-4CE9-9000-8E8B5CB38D2F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "A04C923A-BBBC-4C4A-A653-B14C2CCEF3D9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "E1DE6647-EC65-46DB-BE41-826C0BE3CBF4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "CC47EDCD-06E7-4A5C-BD95-E10CC151494E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "2A5E3508-3BD2-4275-A654-B379EB95A5C2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "DB854FAF-E3B8-4D94-8346-57B73D5B95FE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "40B87228-F144-41C7-ACD8-1168CC5C57F3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "FAC86368-6FD4-4232-9E33-8B14B783C6C9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
"versionStartIncluding": "15.1.0",
"versionEndExcluding": "15.1.10.8",
"matchCriteriaId": "96451762-2663-4773-BA48-CD437150C827"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "304BAC5F-38E2-4629-A4B5-43F2F1AB9CB9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "859A0BFC-CD50-4482-967F-5816F8480B8F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "FB936160-C10D-4556-B5AF-C1BA12C38673"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "9C7A2C91-A997-4F82-A5C3-5F9943B1B6FC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "4E80DD1F-0A18-4536-B501-7B1740A49C68"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "A7B760A6-59A8-46E1-9CA1-23FA27982705"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "B105CC45-1A86-435D-A56F-AD664DA50F50"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "8CF5250B-484E-45CC-89B4-9459300DC6AE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "050656BF-3203-4C95-BF15-C3D1A1A494DD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "3891240B-CB4D-4E2B-AE63-6BF22F3F4B4B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "E6CDB335-7BA3-4BC8-B47A-CC46C5922449"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "7BE02E41-858F-4A18-9878-B9EA7D760470"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "E7215503-77B5-4D6B-8AB8-950B74A53AC6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "C191C32D-0788-4405-B484-331260ADDAD1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "5A7AF326-9537-480E-B9AF-E217638D7239"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "24009DF3-E5AE-42C8-8452-64839C4ED1E5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "C7CA0D19-0DB0-4EEE-95D6-21E71E1583DB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "39889DFE-E0C9-46B6-B4FD-EEB38AB3A2A4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "ECD0333F-74B6-4438-BE6B-7B35304F8065"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "74D5E3BC-68DB-4190-80AC-526F788483C9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
"versionStartIncluding": "16.1.0",
"versionEndExcluding": "16.1.6",
"matchCriteriaId": "AC9024C0-1CD3-4D21-B57E-953525E37A22"
}
]
}
]
}
],
"references": [
{
"url": "https://my.f5.com/manage/s/article/K000150614",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}