CVE-2024-41164

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
F5	BIG-IP	>= 17.1.0, < 17.1.1; >= 16.1.0, < 16.1.5; >= 15.1.0, < 15.1.10
F5	BIG-IP Next CNF	>= 1.1.0, < 1.2.0
F5	BIG-IP Next SPK	>= 1.5.0, < 1.9.0

References

https://my.f5.com/manage/s/article/K000138477Vendor Advisory

Timeline

Published: Aug 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-411659.1A library injection vulnerability exists in Microsoft Word 16.83 for macOS. A specially crafted library can leverage Word's access privilege CVE-2024-411666.1Stack-based buffer overflow in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an CVE-2024-411676.7Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable CVE-2024-411687.4Use after free in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticat CVE-2024-411697.5The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's resources, including directories CVE-2024-41178.8A vulnerability was found in Tenda W15E 15.11.0.14 and classified as critical. Affected by this issue is the function formDelPortMapping of CVE-2024-411707.8A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0015), Tecnomatix Plant Simulation V2404 (All CVE-2024-411718.8A vulnerability has been identified in SINUMERIK 828D V4 (All versions), SINUMERIK 828D V5 (All versions < V5.24), SINUMERIK 840D sl V4 (All CVE-2024-411727.5In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClie CVE-2024-411737.8The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker.CVE-2024-411747.3The IPC-Diagnostics package in TwinCAT/BSD is susceptible to improper input neutralization by a low-privileged local attacker.CVE-2024-411755.5The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker.