Introduction
A single crafted traffic pattern can disrupt all encrypted traffic inspection in a major enterprise, causing outages across critical applications. CVE-2025-41430 exposes this risk in F5 BIG-IP SSL Orchestrator, where remote attackers can force the Traffic Management Microkernel (TMM) to terminate, resulting in denial of service until the process restarts.
F5 Networks is a global leader in application delivery and security, with their BIG-IP platform deployed in thousands of enterprise and service provider networks. The SSL Orchestrator module is widely used for SSL/TLS decryption and traffic inspection, making this vulnerability highly relevant for organizations that rely on deep packet inspection and secure application delivery.
Technical Information
CVE-2025-41430 is a data plane denial of service vulnerability in F5 BIG-IP SSL Orchestrator. When SSL Orchestrator is enabled, remote unauthenticated attackers can send undisclosed traffic that causes the Traffic Management Microkernel (TMM) to terminate. This halts all traffic processing on the affected BIG-IP instance until TMM restarts. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), indicating a resource exhaustion or resource management flaw. The attack does not require authentication and does not impact the control plane or management interfaces. No public exploit details or code snippets are available. F5 tracks this internally as ID 1785245.
Affected Systems and Versions
- Product: F5 BIG-IP SSL Orchestrator
- Vulnerable only when SSL Orchestrator is enabled
- Affected versions:
- 15.1.0 through 15.1.9
- 16.1.0 through 16.1.3 (fixed in 16.1.4 and later)
- 17.0.0 through 17.1.2.1 (fixed in 17.1.2.2 and later)
- Only data plane is affected. Control plane is not impacted.
- All deployment models (hardware, virtual, cloud) are affected if running a vulnerable version with SSL Orchestrator enabled.
Vendor Security History
F5 has previously addressed several high-profile vulnerabilities in the BIG-IP product line, including TMM-related denial of service and remote code execution issues. Notable examples include CVE-2021-22986 (iControl REST authentication bypass) and other TMM resource management flaws. F5 typically provides timely advisories and patches, with structured guidance for affected customers. The company maintains a mature vulnerability response process.