CVE-2025-43878

F5OS-A/C CLI vulnerability

At a glance

Severity: HIGH 8.3
EPSS: EPSS 0.17 % · percentile 7 (2026-10-28)
State: PUBLISHED
Published: 2025-05-07
Updated: 2026-02-26
Assigner: f5
NVD status: Analyzed

Description

When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing system diagnostics tcpdump command utility on a F5OS-C/A system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 6.0	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	f5
CVSS 4.0	HIGH 8.3	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	f5
CVSS 4.0	HIGH 8.3	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · f5sirt@f5.com (Secondary)
CVSS 3.1	MEDIUM 6.0	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	NVD · f5sirt@f5.com (Secondary)

Weaknesses (CWE)

European references

ENISA EUVD · EUVD-2025-13943
GCVE · GCVE-0-2025-43878

CERT-FR advisories

CERTFR-2025-AVI-0382 — Multiples vulnérabilités dans les produits F5 · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:f5:f5os-a:*:*:*:*:*:*:*:* ≥ 1.5.1 < 1.8.0
cpe:2.3:o:f5:f5os-c:*:*:*:*:*:*:*:* ≥ 1.6.0 ≤ 1.6.2

Affected products

Product	Versions
F5 · F5OS - Appliance	affected 1.5.1 < 1.8.0
F5 · F5OS - Chassis	affected 1.6.0 < 1.8.0

References

https://my.f5.com/manage/s/article/K000139502

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD