F5OS CVE-2025-61955

Exploitation requires an attacker to already hold an authenticated local account with low privileges (PR:L) on an F5OS-A or F5OS-C appliance; there is no remote or network vector and no user interaction is needed (AV:L/UI:N). The code-injection flaw (CWE-95) is then used to execute code at a higher privilege level and cross a security boundary. Key limiting factors: the attacker must already be authenticated and have local shell/management access to the device, so realistic risk is confined to multi-tenant deployments, shared-admin environments, or scenarios where an attacker has an existing foothold. Appliances running software versions past End of Technical Support were not evaluated by F5 and may differ.

This is a genuine but second-tier priority. All signals point to a local privilege-escalation issue rather than a remotely exploitable, mass-scannable flaw. The F5-assigned CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms the attacker must already have local access and low-level authenticated privileges on the appliance, which sharply limits the pool of potential attackers - this is a post-compromise or malicious-insider escalation, not an internet-facing breach. The high VC:H/VI:H/VA:H impact and CWE-95 (code injection/eval injection) justify the 8.5 'High' score, because a successful exploit fully crosses a security boundary and yields high confidentiality, integrity, and availability impact on the appliance. EPSS reinforces the lower urgency: 0.25% probability at the 15th percentile indicates very low predicted near-term exploitation, consistent with a local-only vector. There is no CISA KEV listing and no public exploit code referenced, so there is no evidence of active exploitation. The CVSS 4.0 vector and the description are mutually consistent (both indicate local, authenticated access), so there is no contradiction to flag. Net: patch on a normal-to-elevated cadence for exposed/multi-tenant F5OS appliances where low-privileged local accounts exist, but this is not a drop-everything emergency.

A low-privileged user who already has authenticated local access to an F5OS-A or F5OS-C appliance (e.g., a limited operator account or a foothold gained via another issue) injects crafted input into a component that evaluates it as code (CWE-95), executing commands at a higher privilege level. This crosses the appliance's security boundary to gain elevated/root-equivalent control. No public proof-of-concept exploit is referenced in the available data.