F5Os A
Monthly
Privilege escalation in F5OS-A and F5OS-C allows an authenticated attacker with a local low-privilege account to cross a security boundary and obtain high confidentiality, integrity, and availability impact on the appliance operating system. Exploitation requires local access and a valid low-privilege session (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), making this a post-compromise or insider escalation rather than a remote entry vector. No public exploit has been identified at time of analysis; EPSS is 0.21% (10th percentile), and the vendor advisory is K000156771.
F5OS-A on F5 rSeries systems can expose sensitive FIPS hardware security module (HSM) information to a highly privileged, authenticated local user, resulting in a confidentiality-only information disclosure. The defect requires an attacker who already holds high administrative privilege on the appliance and a FIPS/HSM deployment, and the CVSS 4.0 AT:P metric signals an additional specific precondition beyond mere access; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.12% (2nd percentile). Because the attacker must already be a privileged local user, this is best treated as a low-priority, defense-in-depth hardening issue rather than an urgent threat.
Local privilege escalation in F5OS-A and F5OS-C allows an authenticated low-privileged user with local access to execute injected code at a higher privilege level and cross a security boundary. The flaw is rated CVSS 8.5 and classified CWE-95 (eval injection); the assessed vector is local, low-complexity, low-privilege, and no-interaction. No public exploit code or CISA KEV entry was identified in the provided intelligence, and EPSS is 0.25% (15th percentile), so realistic risk is concentrated in environments where an attacker already has a local foothold, such as shared-admin or multi-tenant deployments.
Memory corruption in F5OS-A and F5OS-C is a moderate-priority issue, not a top-tier emergency: an out-of-bounds write can destabilize or crash the appliance and cause availability impact, but exploitation requires network adjacency and low-privilege authenticated access. No public exploit identified at time of analysis and no CISA KEV confirmation was provided; EPSS is low at 0.21% (11th percentile), so exposure is primarily a function of management-network reachability and delegated account hygiene.
Command injection in F5OS-A on F5 rSeries appliances allows a highly privileged authenticated local operator to execute arbitrary system commands during FIPS HSM initialization if the initialization password contains shell metacharacters; this can cross a security boundary and cause the HSM to fail to initialize. The issue is local-only (AV:L) and requires high administrative privileges (PR:H), so it is limited to trusted insider or already-compromised admin contexts, and the independent assessment rates real-world risk LOW-to-MODERATE. EPSS is 0.18% (7th percentile), and no public exploit identified at time of analysis.
SNMP on F5OS-A appliance and F5OS-C chassis systems can be driven into memory exhaustion by undisclosed requests, allowing a low-privileged network actor to degrade or disrupt availability when SNMP is configured. The flaw is a missing-release memory leak (CWE-401) with high availability impact and no confidentiality or integrity effect; exploitation requires SNMP to be enabled and at least low-privileged access per the PR:L vector. No public exploit code or CISA KEV entry was identified, and EPSS is low at 0.38%, so this is a moderate, availability-only risk rather than an emergency patch priority.
On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may be authorized with higher privilege F5OS roles. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing system diagnostics. Rated high severity (CVSS 8.3), this vulnerability is low attack complexity. No vendor patch available.
On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; access via SSH key-based authentication is. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKView directory. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Audit logs on F5OS-A may contain undisclosed sensitive information. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for command injection. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI that allows an attacker to read arbitrary. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Privilege escalation in F5OS-A and F5OS-C allows an authenticated attacker with a local low-privilege account to cross a security boundary and obtain high confidentiality, integrity, and availability impact on the appliance operating system. Exploitation requires local access and a valid low-privilege session (CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), making this a post-compromise or insider escalation rather than a remote entry vector. No public exploit has been identified at time of analysis; EPSS is 0.21% (10th percentile), and the vendor advisory is K000156771.
F5OS-A on F5 rSeries systems can expose sensitive FIPS hardware security module (HSM) information to a highly privileged, authenticated local user, resulting in a confidentiality-only information disclosure. The defect requires an attacker who already holds high administrative privilege on the appliance and a FIPS/HSM deployment, and the CVSS 4.0 AT:P metric signals an additional specific precondition beyond mere access; no public exploit code or active exploitation has been identified, and EPSS is negligible at 0.12% (2nd percentile). Because the attacker must already be a privileged local user, this is best treated as a low-priority, defense-in-depth hardening issue rather than an urgent threat.
Local privilege escalation in F5OS-A and F5OS-C allows an authenticated low-privileged user with local access to execute injected code at a higher privilege level and cross a security boundary. The flaw is rated CVSS 8.5 and classified CWE-95 (eval injection); the assessed vector is local, low-complexity, low-privilege, and no-interaction. No public exploit code or CISA KEV entry was identified in the provided intelligence, and EPSS is 0.25% (15th percentile), so realistic risk is concentrated in environments where an attacker already has a local foothold, such as shared-admin or multi-tenant deployments.
Memory corruption in F5OS-A and F5OS-C is a moderate-priority issue, not a top-tier emergency: an out-of-bounds write can destabilize or crash the appliance and cause availability impact, but exploitation requires network adjacency and low-privilege authenticated access. No public exploit identified at time of analysis and no CISA KEV confirmation was provided; EPSS is low at 0.21% (11th percentile), so exposure is primarily a function of management-network reachability and delegated account hygiene.
Command injection in F5OS-A on F5 rSeries appliances allows a highly privileged authenticated local operator to execute arbitrary system commands during FIPS HSM initialization if the initialization password contains shell metacharacters; this can cross a security boundary and cause the HSM to fail to initialize. The issue is local-only (AV:L) and requires high administrative privileges (PR:H), so it is limited to trusted insider or already-compromised admin contexts, and the independent assessment rates real-world risk LOW-to-MODERATE. EPSS is 0.18% (7th percentile), and no public exploit identified at time of analysis.
SNMP on F5OS-A appliance and F5OS-C chassis systems can be driven into memory exhaustion by undisclosed requests, allowing a low-privileged network actor to degrade or disrupt availability when SNMP is configured. The flaw is a missing-release memory leak (CWE-401) with high availability impact and no confidentiality or integrity effect; exploitation requires SNMP to be enabled and at least low-privileged access per the PR:L vector. No public exploit code or CISA KEV entry was identified, and EPSS is low at 0.38%, so this is a moderate, availability-only risk rather than an emergency patch priority.
On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may be authorized with higher privilege F5OS roles. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing system diagnostics. Rated high severity (CVSS 8.3), this vulnerability is low attack complexity. No vendor patch available.
On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; access via SSH key-based authentication is. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKView directory. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Audit logs on F5OS-A may contain undisclosed sensitive information. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for command injection. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI that allows an attacker to read arbitrary. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.