CVE-2020-5926: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

A vulnerability was identified in BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, tracked as CVE-2020-5926. The issue affects BIG-IP virtual servers configured with a Session Initiation Protocol (SIP) ALG profile. The vulnerability was discovered and assigned on January 6, 2020, and was publicly disclosed on August 26, 2020 (CVE Details).

The vulnerability occurs when parsing SIP messages containing a multi-part MIME payload with certain boundary strings, which can cause TMM (Traffic Management Microkernel) to free memory to the wrong cache. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Under CVSS v2.0, it received a base score of 5.0 (MEDIUM) with vector (AV:N/AC:L/Au:N/C:N/I:N/A:P). The vulnerability is classified as CWE-404: Improper Resource Shutdown or Release (NVD Details).

The vulnerability primarily affects the availability of the system, as indicated by the CVSS scores which show high impact on availability (A:H) but no direct impact on confidentiality or integrity. The improper memory management could potentially lead to system instability or denial of service conditions (NVD Details).

The vulnerability is network accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N) to exploit, as indicated by the CVSS vector (NVD Details).

F5 Networks has addressed this vulnerability in subsequent versions of the affected software. Users should upgrade to versions newer than 14.1.2.6, 15.0.1.3, or 15.1.0.4 depending on their current version branch (Vendor Advisory).