CVE-2024-39778: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

CVE-2024-39778 is a vulnerability affecting F5's BIG-IP system when configured with a High-Speed Bridge (HSB). The vulnerability was discovered and disclosed in August 2024, affecting BIG-IP versions 17.1.0, 16.1.0 through 16.1.4, and 15.1.0 through 15.1.10. This vulnerability allows undisclosed requests to cause the Traffic Management Microkernel (TMM) to terminate (CERT-EU, NVD).

The vulnerability has been assigned a CVSS v4.0 base score of 8.7 (HIGH) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L. Additionally, it has a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is specifically related to the stateless virtual server configuration when used with High-Speed Bridge functionality (NVD).

The primary impact of this vulnerability is the potential for system disruption. When successfully exploited, it can cause the Traffic Management Microkernel (TMM) to terminate, leading to a denial-of-service condition that affects the data plane operations of the BIG-IP system (CERT-EU).

The vulnerability can be exploited by a remote, unauthenticated attacker to trigger a system reboot, which disrupts traffic and causes a denial-of-service (DoS) on the BIG-IP system. The attack vector is network-accessible with low attack complexity and requires no privileges or user interaction (CERT-EU).

F5 has released updates to address this vulnerability. Organizations using affected versions of BIG-IP (17.1.0, 16.1.0 through 16.1.4, and 15.1.0 through 15.1.10) should apply the security updates as soon as possible. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated (NVD).