CVE-2002-20001

CVE-2002-20001 describes a Diffie-Hellman key exchange weakness where a remote attacker (from the client side) can send non-public values to induce expensive server-side DHE modular-exponentiation, potentially impacting availability. The description specifies that the attack is most disruptive wh...

CVE-2022-25990

CVE-2022-25990 affects F5OS-A: vulnerable in 1.0.0, with fix released in 1.0.1. Impact: attacker could obtain read-only access to the Docker registry by exposing registry ports externally. Affected product: F5OS-A; root cause: registry port exposure leading to information disclosure. Remediation:...

CVE-2025-36546

CVE-2025-36546 affects F5OS (Aplpliance mode) where SSH key-based login remains allowed for the root user even after Appliance Mode is enabled, enabling potential unauthorized access if an attacker possesses the root SSH private key. The F5 advisories/Red Hat/NCSC entries describe the issue as a ...

CVE-2025-46265

CVE-2025-46265 describes an improper authorization in F5OS where remotely authenticated users (LDAP, RADIUS, TACACS+) may be granted higher privilege within F5OS roles. The issue affects F5OS-A and F5OS-C branches with vulnerable versions listed in F5 advisory K000139503; fixes are introduced in ...

CVE-2022-41835

CVE-2022-41835 affects F5OS-A (1.x before 1.1.0) and F5OS-C (1.x before 1.5.0). Root cause is excessive file permissions that enable an authenticated local attacker to execute a limited set of commands in a container, impacting the F5OS controller. Affected versions: F5OS-A 1.0.0–1.0.1; F5OS-C 1....

CVE-2023-22657

CVE-2023-22657 affects F5OS-A (versions 1.2.0 up to, but not including, 1.3.0) and F5OS-C (versions 1.3.0 up to, but not including, 1.5.0). The vulnerability arises when processing F5OS tenant file names, enabling command injection. The F5 security advisory K06345931 confirms fixes: F5OS-A fixed ...

CVE-2025-43878

In F5OS-A/C, the CVE-2025-43878 issue affects Appliance mode: an authenticated user with Administrator/Resource Administrator rights can bypass Appliance mode restrictions using the system diagnostics tcpdump command. Vulnerable mappings show F5OS-A versions 1.5.1–1.5.3 and F5OS-C versions 1.6.0–...

CVE-2024-24966

CVE-2024-24966 affects F5OS (A and C branches) where LDAP remote authentication can authorize a remote user without an assigned role. Affected versions: F5OS-A 1.2.0 (vulnerable) with fix in 1.3.0; F5OS-C 1.3.0–1.5.1 (vulnerable) with fix in 1.6.0. Impact is improper authorization (control-plane)...

CVE-2022-41780

CVE-2022-41780 affects F5OS-A (1.x before 1.1.0) and F5OS-C (1.x before 1.4.0). Description: a directory traversal vulnerability in an undisclosed location of the F5OS CLI could allow reading arbitrary files. Remediation per F5 advisory K81701735 is to upgrade to fixed versions: F5OS-A 1.1.0 and ...

CVE-2023-36494

The CVE-2023-36494 issue affects F5OS-A, specifically audit-service on F5OS-A 1.4.0 with a path to 1.5.0. The vulnerability allows authenticated, high-privilege users with local access to read undisclosed sensitive information from audit logs. CVSSv3 base score is 4.4 (Medium) with local attack v...

CVE-2024-23607

CVE-2024-23607 affects F5OS QKView utility. An authenticated attacker can traverse directories to read files outside the QKView directory. Vulnerable: F5OS-QKView in F5OS-A (1.3.0–1.3.2) and F5OS-C (1.3.0–1.5.1) branches; fixed in F5OS-A 1.4.0 and F5OS-C 1.6.0 per K000132800/K000138353. CVSSv3 ba...

CVE-2025-53860

The CVE-2025-53860 issue affects F5OS-A software on F5 rSeries appliances. A highly privileged authenticated attacker can read sensitive FIPS HSM information via the vulnerable components, with impact limited to control-plane exposure and no data-plane exposure reported. Affected versions include...

CVE-2025-61955

CVE-2025-61955 (F5OS-A/F5OS-C) : An authenticated attacker with local access can escalate privileges on F5OS-A or F5OS-C, potentially crossing a security boundary. Affected: F5OS-A versions up to 1.8.03 (vulnerable: 1.5.1–1.5.3; fixes in 1.8.3) and F5OS-C versions up to 1.8.1/1.6.x (vulnerable ra...

CVE-2025-57780

CVE-2025-57780 affects F5OS-A and F5OS-C. An authenticated attacker with local access can escalate privileges, potentially bypassing Appliance mode and execute arbitrary system commands with higher privileges (control plane issue). Severity is high (CVSSv3.1 up to 7.8 standard, 8.8 appliance). Re...

CVE-2025-60013

CVE-2025-60013 affects F5OS-A FIPS HSM password initialization. A highly privileged, authenticated attacker could use a password with special shell metacharacters to initialise the rSeries FIPS module, potentially executing arbitrary system commands and crossing a security boundary. Affected hard...

CVE-2025-60015

The CVE-2025-60015 issue affects F5OS-A and F5OS-C with an out-of-bounds write leading to memory corruption. Per the F5 advisory, vulnerable versions include F5OS-A 1.8.03 and 1.5.1–1.5.3, plus F5OS-C 1.8.0–1.8.1 and 1.6.0–1.6.23. Remediation is available via updates: F5OS-A to 1.8.3 (and later),...

CVE-2025-47150

CVE-2025-47150 describes a SNMP handling issue on F5OS-A and F5OS-C where undisclosed SNMP requests can cause memory resource utilization to rise, potentially degrading performance or causing DoS. Connected advisories confirm affected products and provide fixes. For F5OS-A, vulnerable ranges are ...