F5OS-A/F5OS-C CVE-2025-57780

Exploitation requires (1) local access to the F5OS-A or F5OS-C appliance operating system and (2) an existing authenticated account at low privilege (PR:L) - it is not remotely reachable and not usable by an unauthenticated attacker. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker has a valid low-tier local session the escalation is straightforward. Limiting factors: the attacker must already have a credentialed foothold on the device, software versions past End of Technical Support are not evaluated by the vendor (so exposure claims for EoTS builds are unverified), and the impact is confined to the affected system (no modeled subsequent-system spread). This is fundamentally an insider or post-compromise escalation condition, not an external entry vector.

This is a locally-exploitable privilege escalation flaw (CWE-250, Execution with Unnecessary Privileges) in F5OS-A and F5OS-C. Signals are internally consistent and point to a moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms the attacker must already have local access and low-level authenticated privileges on the appliance OS, which meaningfully limits the exposed population to insiders or an attacker who has already gained a foothold. Impact is severe once triggered - VC:H/VI:H/VA:H indicate full confidentiality, integrity and availability compromise of the vulnerable system - but subsequent-system impact is explicitly N (SC:N/SI:N/SA:N), so the vendor does not model blast radius beyond the device. EPSS is low at 0.21% (10th percentile), the CVE is NOT on CISA KEV, and no public exploit was provided, so there is no evidence of active or imminent widespread exploitation. The signals do not conflict: a high base score (8.5) driven by high impact is tempered by the local-access and prior-privilege prerequisites and low exploitation probability. Net: a genuine defense-in-depth concern for F5 appliance operators (because it defeats a privilege boundary on security infrastructure) but not a drop-everything internet-facing emergency. One ambiguity to verify with the vendor: the description says 'cross a security boundary,' which can imply a scope/containment escape, yet the 4.0 vector sets SC/SI/SA to N (no subsequent-system impact) - confirm with F5 whether the boundary crossed is purely intra-system privilege elevation.

An attacker who already holds a low-privileged authenticated account with local/CLI access to an F5OS-A or F5OS-C appliance (for example a limited operator login or a compromised low-tier credential) abuses a component that runs with unnecessary/elevated privileges to execute actions as a higher-privileged identity. This elevates them to full control of the appliance OS, undermining the trust boundary of a network security device. No public exploit code was identified at time of analysis, and local access plus existing credentials are required, keeping this a post-foothold rather than a remote-entry scenario.