F5OS-A CVE-2025-53860

Exploitation requires an attacker to be a highly privileged, authenticated local user (CVSS PR:H, AV:L) on an F5 rSeries system running F5OS-A with a FIPS hardware security module present/configured - the vulnerability specifically concerns exposure of FIPS HSM information, so a non-FIPS deployment is not in scope. The CVSS 4.0 AT:P metric indicates a specific precondition beyond mere access must be met for the sensitive information to be exposed. Strong limiting factors: no remote vector, no unauthenticated path, and the requirement for pre-existing high administrative privilege mean a successful attacker has effectively already compromised the appliance. End-of-Technical-Support software versions were not evaluated and may differ.

This is a low-priority, defense-in-depth issue rather than an urgent threat. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:H/UI:N, VC:H only) scores 5.6 (Medium) and is internally consistent with the description: local access (AV:L), high privileges already required (PR:H), a present-but-not-trivial attack requirement (AT:P), and a confidentiality-only impact (VC:H, VI:N/VA:N). All exploitation signals point the same direction and reinforce low real-world risk: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing (not actively exploited), and no public exploit has been identified at time of analysis. The critical limiting factor is that the attacker must ALREADY be a highly privileged authenticated user on the F5OS-A system - meaning an adversary who could exploit this has largely already compromised the appliance. The only mild tension worth noting is that CWE-214 (invocation of a process exposing sensitive information) combined with the FIPS HSM context implies the disclosed data could be cryptographically sensitive, which raises impact severity even though exploitability is low; however, no independent confirmation of exactly what HSM material is exposed is available beyond the vendor article. Net: a genuine but low-urgency hardening fix, not a patch-tonight emergency.

An attacker who has already obtained highly privileged administrative credentials on an F5 rSeries system running F5OS-A invokes or observes a process/command that inadvertently exposes sensitive FIPS HSM information. Because local access and high privilege are prerequisites, this is realistically a post-compromise or malicious-insider action that extends an existing foothold rather than an initial intrusion. No public proof-of-concept exploit code has been identified.