Report feedback

An authenticated remote attacker can, due to incorrect authorization when using external authentication (LDAP, RADIUS, TACACS+) on F5OS-A and F5OS-C instances, escalate their privileges (e.g. to the F5OS administrator role). If it is not possible to update to a fixed version immediately, the risk can be temporarily mitigated by configuring the remote authentication directory so that no groups use group ID (GID) values reserved by the F5OS system (e.g. 9000 or 9001). Detailed information on the vulnerability and the temporary workaround can be found at [2].

The vulnerability is present in products:

• F5OS-A:F5OS-A; ==1.5.1;
• F5OS-C:F5OS-C; >=1.6.0, <=1.6.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2025-46265 at cve.org, NVD
• CWE-863: Incorrect Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 7. 5. 2025.

An authenticated remote attacker with administrator privileges can, on BIG-IP systems running in Appliance mode, execute arbitrary system commands in the Advanced Shell (bash) and create or delete files via the iControl REST interface or local access through the TMOS Shell (tmsh). If an immediate update to a fixed version is not possible, the risk can be temporarily mitigated by restricting access to the iControl REST interface and the command line over SSH to trusted networks and devices, following one of the procedures at [3].

The vulnerability is present in product:

• *:BIG-IP; >=15.1.0, <=15.1.10; >=16.1.0, <=16.1.5; >=17.1.0, <=17.1.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

More information:

• CVE-2025-31644 at cve.org, NVD
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 5. 2025.

An unauthenticated remote attacker can gain unauthorized access to the system in Appliance mode on F5OS-A and F5OS-C instances if SSH key-based access was previously enabled by the root user and the attacker obtains the private key corresponding to one of the entries in the root "authorized_keys" file. If an immediate update to a fixed version is not possible, the risk can be temporarily mitigated by removing all configured public SSH keys before starting Appliance mode [4].

The vulnerability is present in products:

• F5OS-A:F5OS-A; >=1.5.1, <=1.5.2;
• F5OS-C:F5OS-C; >=1.6.0, <=1.6.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

• CVE-2025-36546 at cve.org, NVD
• CWE-863: Incorrect Authorization at cwe.mitre.org

The vulnerability was publicly disclosed 7. 5. 2025.

An unauthenticated remote attacker can carry out a DoS attack on BIG-IP, BIG-IP Next, BIG-IP Next CNF and BIG-IP Next SPK systems by sending specially crafted requests to a virtual server with an active Stream Control Transmission Protocol (SCTP) profile. If an immediate update to a fixed version is not possible, the impact of the vulnerability can be temporarily mitigated by deploying BIG-IP in high availability (HA) mode. Detailed information on the vulnerability and the temporary workaround is available at [5].

The vulnerability is present in products:

• *:BIG-IP; >=15.1.0, <=15.1.8; >=16.1.0, <=16.1.3; ==17.1.0;
• *:BIG-IP Next; ==20.2.0;
• *:BIG-IP Next CNF; >=1.1.0, <=1.2.1;
• *:BIG-IP Next SPK; >=1.7.0, <=1.7.11; >=1.8.0, <=1.9.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-41399 at cve.org, NVD
• CWE-404: Improper Resource Shutdown or Release at cwe.mitre.org

The vulnerability was publicly disclosed 7. 5. 2025.

An unauthenticated remote attacker can carry out a DoS attack on BIG-IP, BIG-IP Next SPK and BIG-IP Next CNF systems by means of specially crafted HTTP requests sent to a virtual server with the Enforce RFC Compliance option enabled in the HTTP profile. If an immediate update to a fixed version is not possible, the impact of the vulnerability can be temporarily mitigated by deploying the system in high availability (HA) mode. Detailed information on the vulnerability and the temporary workaround is available at [6].

The vulnerability is present in products:

• *:BIG-IP; >=16.1.0, <=16.1.4; >=17.1.0, <=17.1.1;
• *:BIG-IP Next CNF; >=1.1.0, <=1.3.3;
• *:BIG-IP Next SPK; >=1.7.0, <=1.7.8; >=1.8.0, <=1.9.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-36557 at cve.org, NVD
• CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 5. 2025.

An unauthenticated remote attacker can carry out a DoS attack on BIG-IP, BIG-IP Next, BIG-IP Next CNF and BIG-IP Next SPK systems by means of specially crafted responses sent to a virtual server with an active HTTP/2 profile of the httprouter type. If an immediate update to a fixed version is not possible, the impact of the vulnerability can be temporarily mitigated by deploying the system in high availability (HA) mode. Detailed information on the vulnerability and the temporary workaround is available at [7].

The vulnerability is present in products:

• *:BIG-IP; >=16.1.0, <=16.1.5; >=17.1.0, <=17.1.1;
• *:BIG-IP Next; >=20.2.0, <=20.2.1;
• *:BIG-IP Next CNF; >=1.1.0, <=1.4.1;
• *:BIG-IP Next SPK; >=1.7.0, <=1.9.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

• CVE-2025-36504 at cve.org, NVD
• CWE-770: Allocation of Resources Without Limits or Throttling at cwe.mitre.org

The vulnerability was publicly disclosed 7. 5. 2025.