F5OS-C CVE-2025-59778

Exploitation is possible ONLY when the 'Allowed IP Addresses' feature is configured on the F5OS-C partition control plane; this is the exact named prerequisite from the vendor description, so default deployments without this feature enabled are not exploitable. When that feature is enabled, no authentication (PR:N) and no user interaction (UI:N) are required, and the attacker only needs network reachability to the partition control-plane/management interface. Limiting factors that reduce real-world risk: the non-default feature requirement, the typical practice of isolating F5OS-C management/control-plane interfaces on restricted management networks, and the availability-only impact (reachability to the control plane is the gating constraint). End-of-Technical-Support software versions are not evaluated and their exposure is undetermined.

This is a denial-of-service vulnerability (CWE-770, uncontrolled resource consumption) in the F5OS-C partition control plane. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated trigger, which on paper is attractive to attackers; however, the impact metrics are availability-only (VC:N/VI:N, VA:L with subsequent-system SA:H), confirming there is no confidentiality or integrity exposure - this is strictly an availability/outage issue, not code execution or data theft. Real-world risk is materially lower than the 7.7 'High' base score suggests for three reasons: (1) EPSS is only 0.34% (25th percentile), indicating low modeled exploitation likelihood; (2) the vulnerability is NOT in CISA KEV and no public exploit code was identified; and (3) exploitation requires that the optional 'Allowed IP Addresses' feature be configured on the partition control plane, so default/unconfigured deployments are not affected. The signals are therefore consistent rather than conflicting: a genuinely exploitable but config-gated DoS with no observed exploitation. Priority should be driven by whether an organization has actually enabled the Allowed IP Addresses feature on internet- or management-network-reachable F5OS-C control planes, not by the headline score. Note the vendor explicitly excludes End-of-Technical-Support versions from evaluation, so EoTS deployments have an unknown status.

An attacker with network access to the F5OS-C partition control plane - where the Allowed IP Addresses feature has been enabled - sends undisclosed/malformed traffic to the management interface. The traffic causes multiple control-plane containers to terminate, disrupting management and services on the affected VELOS chassis partition. No authentication or user interaction is required, but no public proof-of-concept exists to lower the attacker's effort.