F5OS-A CVE-2025-60013

Exploitation requires the attacker to already be a highly-privileged, authenticated operator on the F5OS-A rSeries appliance (PR:H) with local access (AV:L), and to actively perform the FIPS HSM initialization workflow supplying a password that contains shell metacharacters - this operator-initiated configuration action IS the trigger. Limiting factors: no remote or network-based path (local vector only), no unauthenticated access, and the requirement for high administrative privilege mean a fully-untrusted attacker cannot reach this; it is confined to insiders or already-compromised admin contexts. Software versions past End of Technical Support (EoTS) were not evaluated, so applicability is limited to supported rSeries FIPS platforms (CPE references F5OS-A 1.8.0).

Real-world risk is LOW-to-MODERATE and all available signals agree on this. The CVSS 4.0 vector (AV:L/AC:L/PR:H/UI:N) describes a local, high-privilege-required flaw with only Low confidentiality and integrity impact and no availability impact, yielding a base score of 4.6 (Medium). EPSS reinforces this: 0.18% probability at the 7th percentile indicates exploitation is considered very unlikely. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation. The vendor (F5 SIRT, f5sirt@f5.com) self-reported the issue, which is a reliable primary source. The one genuinely notable signal is the stated consequence - crossing a security boundary via OS command injection (CWE-78) during FIPS HSM initialization - but this is strongly gated by the PR:H requirement: the attacker must already hold highly-privileged authenticated access to the appliance. No signals conflict. This is a defense-in-depth / hardening fix for an already-trusted operator action, not an urgent remotely-exploitable priority.

A malicious or compromised administrator with high-privilege access to an F5OS-A rSeries appliance initializes the FIPS HSM using a password containing shell metacharacters (e.g. ;, |, $(...)), causing those characters to be interpreted by the underlying shell and arbitrary system commands to execute in that context. No public exploit code or active exploitation has been identified; exploitation requires existing privileged authenticated access, so it primarily represents an insider or post-compromise privilege/boundary escalation path.