This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] F5 fixes 44 vulnerabilities in its products

F5 fixes 44 vulnerabilities in its products. The most severe ones are listed below, the remaining ones can be found at [1], including detailed information on fixed versions.

F5 BIG-IP - restrictions bypass (CVE-2025-53868)
CVSS 8.7 (High)

Allows an authenticated remote attacker with valid credentials and access to SCP and SFTP to bypass Appliance mode restrictions in BIG-IP due to a vulnerability in the handling of undisclosed commands [2].

The vulnerability is present in product:

  • BIG-IP; >=17.5.0, <17.5.1; >=17.1.0, <=17.1.2; >=16.1.0, <=16.1.6, >=15.1.0, <=15.1.10

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

More information:

  • CVE-2025-53868 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). at cwe.mitre.org

The vulnerability was publicly disclosed 15. 10. 2025.

F5 F5OS-A, F5OS-C - arbitrary command execution (CVE-2025-61955)
CVSS 8.8 (High)

Allows an authenticated local attacker to escalate privileges and execute arbitrary system commands in F5OS-A and F5OS-C [3].

The vulnerability is present in products:

  • F5OS-A; >=1.8.0, <1.8.3; >=1.5.1, <=1.5.3
  • F5OS-C; >=1.8.0, <=1.8.1; >=1.6.0, <=1.6.2

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2025-61955 at cve.org, NVD
  • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 15. 10. 2025.

F5 F5OS-A, F5OS-C - arbitrary command execution (CVE-2025-57780)
CVSS 8.8 (High)

Allows an authenticated local attacker to escalate privileges and execute arbitrary system commands in F5OS-A and F5OS-C [4].

The vulnerability is present in products:

  • F5OS-A; >=1.8.0, <1.8.3; >=1.5.1, <=1.5.3
  • F5OS-C; >=1.8.0, <=1.8.1; >=1.6.0, <=1.6.2

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 15. 10. 2025.

F5 BIG-IP, BIG-IP Next SPK, BIG-IP Next CNF - DoS (CVE-2025-60016)
CVSS 7.5 (High)

Allows an unauthenticated remote attacker to perform a DoS attack when Diffie-Hellman (DH) ECC Brainpool curves are used in an SSL profile (Cipher Rule or Cipher Group) assigned to a virtual server in BIG-IP, BIG-IP Next SPK and BIG-IP Next CNF [5].

The vulnerability is present in products:

  • BIG-IP; >=17.1.0, <=17.1.1
  • BIG-IP Next SPK; >=1.7.0, <=1.9.2
  • BIG-IP Next CNF; >=1.1.0, <=1.3.3

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

  • CVE-2025-60016 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 15. 10. 2025.

F5 BIG-IP Next SPK, BIG-IP Next CNF, BIG-IP Next for Kubernetes - DoS (CVE-2025-58120)
CVSS 7.5 (High)

Allows an unauthenticated remote attacker to perform a DoS attack due to the processing of unspecified network traffic when HTTP/2 Ingress is configured in BIG-IP Next SPK, BIG-IP Next CNF and BIG-IP Next for Kubernetes [6].

The vulnerability is present in products:

  • BIG-IP Next SPK; >=2.0.0, <2.0.1; >=1.7.0, <=1.7.14
  • BIG-IP Next CNF; >=2.0.0, <2.0.1; >=1.1.0, <=1.4.1
  • BIG-IP Next for Kubernetes; >=2.0.0, <2.1.0

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 15. 10. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 17. 10. 2025.

CESNET, z.s.p.o. Logo