F5OS-A/C CVE-2025-60015
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network access to appliance
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted input triggering out-of-bounds write
-
ExecutionCorrupt memory in F5OS process
-
ImpactCrash service / denial of availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network adjacency to the F5OS-A or F5OS-C appliance - i.e., access to the same logical/physical network segment or management network, per AV:A, not arbitrary internet reach; and (2) low-privilege authenticated access to the platform (PR:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L). These two prerequisites - adjacency and valid low-privilege credentials - are the primary limiting factors that reduce real-world exposure below a remote-unauthenticated scenario. The description does not name a specific feature or non-default configuration, so the condition is understood to apply to standard F5OS deployments rather than an opt-in mode; verify against F5 article K000156796. |
| Impact | This is a moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N) describes an adjacent-network, low-complexity attack that requires low privileges and no user interaction, with impact limited purely to availability (VA:H; VC:N/VI:N). The out-of-bounds write (CWE-787) is therefore best understood as a denial-of-service / crash vector against the F5OS platform rather than a code-execution or data-disclosure flaw, despite 'memory corruption' language that could in theory imply more. Supporting signals align with a lower real-world urgency: EPSS is only 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit was found. The signals are internally consistent - modest severity (6.9), adjacency + authentication requirements, availability-only impact, and low exploitation probability all point the same direction. The main uncertainty is the vendor advisory content: the NVD description is sparse ('could lead to memory corruption') and does not confirm whether the corruption is bounded to a crash or could be leveraged further - the VC:N/VI:N/VA:H scoring strongly implies availability-only, but this should be verified against F5 article K000156796. |
| Exploit ScenarioDerived | An attacker already on an adjacent network segment to an F5OS-A or F5OS-C appliance, holding low-privilege credentials, sends crafted input to a vulnerable interface that triggers an out-of-bounds write. The resulting memory corruption crashes or destabilizes the platform, causing a denial of service. No public proof-of-concept exploit was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Memory corruption in F5OS-A and F5OS-C is a moderate-priority issue, not a top-tier emergency: an out-of-bounds write can destabilize or crash the appliance and cause availability impact, but exploitation requires network adjacency and low-privilege authenticated access. No public exploit identified at time of analysis and no CISA KEV confirmation was provided; EPSS is low at 0.21% (11th percentile), so exposure is primarily a function of management-network reachability and delegated account hygiene.
RemediationAI
Patch status is not confirmed by the supplied data; use F5 advisory K000156796 to identify the fixed F5OS-A/F5OS-C release and upgrade to that vendor-specified version rather than assuming any wildcard-covered build is safe. Until that upgrade is applied, reduce the two assessed prerequisites: enforce network segmentation and ACLs around F5OS management/adjacent interfaces so only trusted hosts can reach them (trade-off: tighter administrative access and possible operational friction), and remove or tightly scope low-privilege accounts on the platform (trade-off: fewer delegated operators and more centralized administration). Add alerting for unexpected appliance resets, service restarts, or memory-related faults as a detection-only control (trade-off: does not prevent exploitation), and avoid relying on EoTS releases, which F5 does not evaluate.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-787, an out-of-bounds write in which data is written beyond the intended bounds of a memory buffer, corrupting adjacent memory and potentially causing service or appliance instability. F5OS-A and F5OS-C are F5 platform operating systems for appliance/chassis deployments; the supplied CPEs identify the f5os-a and f5os-c OS families, including a specific f5os-a 1.8.0 entry, but do not provide a complete version matrix. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) and the independent CVSS 3.1 assessment (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) agree that the practical impact is availability-only and that an attacker needs adjacency plus low-privilege credentials; no confidentiality or integrity impact is assessed.
Know when F5Os A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent vector and authenticated low-privilege access per vendor data (AV:A/PR:L); out-of-bounds write yields availability-only impact (A:H, C:N/I:N) with no scope change.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
DescriptionCVE.org
An out-of-bounds write vulnerability exists in F5OS-A and F5OS-C that could lead to memory corruption.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Affected Products (CPE)CVE.org
On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an aut
On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may b
Local privilege escalation in F5OS-A and F5OS-C allows an authenticated low-privileged user with local access to execute
Privilege escalation in F5OS-A and F5OS-C allows an authenticated attacker with a local low-privilege account to cross a
When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may
On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F
SNMP on F5OS-A appliance and F5OS-C chassis systems can be driven into memory exhaustion by undisclosed requests, allowi
F5OS-A on F5 rSeries systems can expose sensitive FIPS hardware security module (HSM) information to a highly privileged
When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly author
A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read file
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an
GitHub PoC
Exploit-DB