Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-41431
CVE-2025-41431:
F5 BIG-IP Virtual Edition (tier - best) vulnerability analysis and mitigation
Overview
CVE-2025-41431 affects BIG-IP systems when connection mirroring is configured on a virtual server. The vulnerability was discovered and disclosed on May 7, 2025, impacting the Traffic Management Microkernel (TMM) in standby BIG-IP systems within a traffic group (NVD).
Technical details
The vulnerability is characterized by a high severity rating with a CVSS v4.0 base score of 8.7 HIGH and CVSS v3.1 base score of 7.5 HIGH. The vulnerability is classified as an Out-of-bounds Write (CWE-787) issue. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N) (NVD).
Impact
When exploited, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate in the standby BIG-IP systems that are part of a traffic group. This primarily affects the availability of the system, as indicated by the CVSS metrics showing high impact on availability (VA:H) but no impact on confidentiality or integrity (NVD).
Mitigation and workarounds
F5 Networks has documented this vulnerability and provided mitigation information. Software versions that have reached End of Technical Support (EoTS) are not evaluated. For specific mitigation steps and patches, users should refer to F5's official security advisory (F5 Article).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management