Technical impact
The vulnerability allows locally generated Ethernet traffic to trigger an increase in Packet Velocity Acceleration (ePVA) activity and Traffic Management Microkernel (TMM) resource consumption. This reflects a flaw in the system’s control of internal resource usage (CWE‑835). When exploited, the increased resource demand can degrade performance or potentially cause a denial of service, without directly affecting data confidentiality or integrity.
Affected Systems
Affected systems are F5 BIG‑IP devices. No specific product versions are listed in the vendor data, so the impact applies to all F5 BIG‑IP installations that have ePVA acceleration enabled and for which End of Technical Support status is not reached.
Risk and Exploitability
The CVSS score of 7.1 indicates moderate to high severity, but the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to inject local Ethernet traffic that can reach the affected BIG‑IP, implying a local or network‑proximity threat. The lack of public exploitation data suggests the risk is primarily theoretical, yet the resource‑exhaustion nature warrants monitoring and mitigation.
