F5OS CVE-2025-47150
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privilege access to SNMP interface
-
DeliverySend repeated undisclosed SNMP requests
-
ExploitTrigger unreleased memory allocation (CWE-401)
-
ExecutionExhaust SNMP memory resources
-
ImpactDegrade or disrupt availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Exploitation requires that SNMP be configured on the F5OS Appliance (f5os-a) or Chassis (f5os-c) system - if SNMP is not enabled/configured, the vulnerable code path is not reachable. The CVSS vector's PR:L indicates some level of authentication or privilege is required to submit the triggering requests, which limits exploitation to actors with at least low-privileged access to the SNMP interface. Impact is limited to availability (memory exhaustion); there is no confidentiality or integrity impact. End-of-Technical-Support software versions were not evaluated by F5 and are outside the assessed scope. |
| Impact | This is a moderate-severity, availability-only issue that does not warrant emergency prioritization. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scored 7.1 by the F5 SIRT CNA describes a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with impact confined entirely to availability (VA:H) via memory exhaustion - consistent with CWE-401 (missing release of memory). There is no confidentiality or integrity impact. Exploitation signals are weak and mutually consistent: EPSS is only 0.38% (30th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced - so this is no public exploit identified at time of analysis. The signals do not conflict: a low EPSS, absence from KEV, and an availability-only resource-exhaustion bug together indicate a real but non-urgent hardening issue rather than an actively targeted threat. One caveat: the input Tags label this 'Information Disclosure,' which contradicts the CVSS vector (VC:N, no confidentiality impact) and the CWE-401 memory-leak classification - the tag appears mislabeled and should not drive risk decisions. |
| Exploit ScenarioDerived | An attacker with low-level authenticated access and network reachability to the SNMP service on an F5OS Appliance or Chassis system sends repeated undisclosed/crafted SNMP requests. Each request causes SNMP memory utilization to grow without being released, gradually exhausting resources and degrading or disrupting the SNMP subsystem and potentially overall device stability. No public exploit code is known, and the attack yields no data disclosure - only availability degradation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
SNMP on F5OS-A appliance and F5OS-C chassis systems can be driven into memory exhaustion by undisclosed requests, allowing a low-privileged network actor to degrade or disrupt availability when SNMP is configured. The flaw is a missing-release memory leak (CWE-401) with high availability impact and no confidentiality or integrity effect; exploitation requires SNMP to be enabled and at least low-privileged access per the PR:L vector. No public exploit code or CISA KEV entry was identified, and EPSS is low at 0.38%, so this is a moderate, availability-only risk rather than an emergency patch priority.
RemediationAI
Apply the F5OS-A and F5OS-C fix identified in F5 advisory K000149820 at https://my.f5.com/manage/s/article/K000149820; the provided data does not include an exact fixed version, so confirm the target release in the advisory before upgrading. If SNMP is not required, disable it to remove the vulnerable code path entirely. Where SNMP must remain enabled, restrict access to trusted management networks and authorized SNMP users/communities, monitor SNMP memory utilization for sustained growth, and rate-limit or filter SNMP requests at the network edge. These mitigations reduce exposure but do not replace the vendor fix, and disabling SNMP will break monitoring integrations that rely on it.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
F5OS-A and F5OS-C are the operating system families for F5 appliances and chassis, and SNMP is an optional management/monitoring service that can be configured on them. CVE-2025-47150 is rooted in CWE-401, missing release of memory after its effective lifetime, meaning the SNMP subsystem does not properly free memory allocated while handling certain undisclosed requests. Repeated or sustained triggering requests can therefore accumulate memory usage until SNMP memory resources are exhausted, producing a denial-of-service condition that affects availability only. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VA:H/SC:N/SI:N/SA:N and the independent CVSS 3.1 assessment AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H both reflect a network-reachable, low-complexity issue requiring low privileges and no user interaction, with no confidentiality or integrity impact. The vulnerable path is not reachable unless SNMP is configured, and F5 states that End of Technical Support versions were not evaluated. CPE data identifies F5OS-A and F5OS-C as the affected OS families, but the input does not provide discrete version ranges.
Know when F5Os A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable SNMP with no user interaction (AV:N/AC:L/UI:N); PR:L because requests require privileged SNMP access; availability-only memory exhaustion so C:N/I:N/A:H.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
DescriptionCVE.org
When SNMP is configured on F5OS Appliance and Chassis systems, undisclosed requests can cause an increase in SNMP memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
F5OS-A appliances and F5OS-C chassis systems with SNMP enabled are exposed to a memory-exhaustion condition that can degrade or disrupt availability for a low-privileged network actor. The issue has no confidentiality or integrity impact and no public exploit identified at time of analysis, but service interruption is the leadership concern for teams relying on these platforms for network and chassis management. Because exploitation requires SNMP to be configured and authenticated low-privileged access (PR:L), exposure is concentrated in environments with broad management-plane access.
No vendor-released patch identified at time of analysis; disable SNMP if unused, restrict SNMP access to trusted management networks and approved hosts, enforce least-privilege SNMP credentials and rotate them, segment management access, and monitor F5OS-A/F5OS-C memory and SNMP traffic for exhaustion symptoms.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an aut
On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may b
Local privilege escalation in F5OS-A and F5OS-C allows an authenticated low-privileged user with local access to execute
Privilege escalation in F5OS-A and F5OS-C allows an authenticated attacker with a local low-privilege account to cross a
When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may
On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F
Memory corruption in F5OS-A and F5OS-C is a moderate-priority issue, not a top-tier emergency: an out-of-bounds write ca
F5OS-A on F5 rSeries systems can expose sensitive FIPS hardware security module (HSM) information to a highly privileged
When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly author
A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read file
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an
GitHub PoC
Exploit-DB