CVE-2025-46265 Overview
CVE-2025-46265 is an improper authorization vulnerability [CWE-863] in F5OS that affects how remotely authenticated users are assigned roles. When users authenticate through Lightweight Directory Access Protocol (LDAP), Remote Authentication Dial-In User Service (RADIUS), or Terminal Access Controller Access-Control System Plus (TACACS+), the system may grant them higher privilege F5OS roles than intended. The flaw impacts both F5OS-A (appliance) and F5OS-C (chassis) platforms. F5 has not evaluated software versions that have reached End of Technical Support (EoTS). The vulnerability carries a CVSS v4.0 score of 8.7 and is exploitable over the network by an authenticated user with low privileges.
Critical Impact
Remotely authenticated users may obtain elevated F5OS administrative roles, enabling unauthorized configuration changes and full control over affected appliances and chassis systems.
Affected Products
- F5 F5OS-A (appliance software, including version 1.5.1)
- F5 F5OS-C (chassis software)
- Deployments using remote authentication via LDAP, RADIUS, or TACACS+
Discovery Timeline
- 2025-05-07 - CVE-2025-46265 published to the National Vulnerability Database
- 2025-10-21 - Last updated in NVD database
Technical Details for CVE-2025-46265
Vulnerability Analysis
The vulnerability is an improper authorization weakness classified under [CWE-863]. F5OS uses remote authentication providers to validate user credentials and map external identities to internal F5OS roles. The role assignment logic does not correctly enforce the privilege level returned by the remote authentication server. As a result, users authenticating through LDAP, RADIUS, or TACACS+ can be assigned a higher F5OS role than their directory or policy attributes specify. An attacker holding valid low-privilege remote credentials can use this flaw to gain administrative capabilities on the F5OS management plane. Because F5OS controls the underlying platform of F5 BIG-IP appliances and chassis, elevated access can extend to network traffic configuration, tenant management, and platform services.
Root Cause
The root cause is incorrect authorization handling during the mapping between remote authentication attributes and F5OS local roles. The system fails to consistently validate the role granted to an authenticated identity before applying it to the session. F5 has not published the specific code path or mapping logic involved in the public advisory.
Attack Vector
The attack vector is network-based and requires prior low-privilege authentication. An attacker with valid LDAP, RADIUS, or TACACS+ credentials connects to the F5OS management interface. During session establishment, F5OS assigns an elevated role due to the authorization flaw. No user interaction is required. See the F5 Technical Article K000139503 for vendor-specific guidance on affected versions.
No verified proof-of-concept code is publicly available for this vulnerability. Refer to the F5 security advisory for technical specifics.
Detection Methods for CVE-2025-46265
Indicators of Compromise
- Authentication events where remote users (LDAP, RADIUS, TACACS+) are recorded with admin or other high-privilege F5OS roles inconsistent with their directory group membership
- Unexpected configuration changes on F5OS-A or F5OS-C platforms following remote logins
- New tenant creation, service restarts, or platform-level modifications by users not previously assigned administrative roles
Detection Strategies
- Audit F5OS authentication and authorization logs and correlate the role assigned at session creation with the user's expected role in the upstream identity provider
- Compare RADIUS or TACACS+ accounting records with F5OS session records to find discrepancies in privilege level
- Alert on any privileged F5OS API or CLI command issued by accounts sourced from remote authentication providers
Monitoring Recommendations
- Forward F5OS audit logs to a centralized logging platform and retain them for forensic review
- Monitor administrative actions on the F5OS management plane in near real time
- Establish baselines for normal remote-user activity and alert on deviations such as role changes mid-session
How to Mitigate CVE-2025-46265
Immediate Actions Required
- Review the F5 Technical Article K000139503 and identify whether deployed F5OS-A and F5OS-C versions are affected
- Apply the fixed F5OS software versions listed in the F5 advisory as soon as maintenance windows allow
- Restrict network access to the F5OS management interface to trusted administrative networks only
- Audit existing remote user accounts and revoke any roles granted in error
Patch Information
F5 has published remediation guidance in F5 Technical Article K000139503. Administrators should upgrade affected F5OS-A and F5OS-C installations to the fixed versions identified in that article. F5OS releases that have reached End of Technical Support are not evaluated and should be replaced with supported versions.
Workarounds
- Disable remote authentication via LDAP, RADIUS, or TACACS+ on F5OS management until the patch is applied, and use local accounts with strong credentials
- Limit F5OS management plane reachability to a dedicated out-of-band management network
- Enforce least privilege on the identity provider side and minimize the number of users authorized to authenticate to F5OS
# Restrict F5OS management access at the network layer (example ACL concept)
# Permit only the dedicated management subnet to reach F5OS management interfaces
permit tcp 10.10.10.0/24 host <f5os-mgmt-ip> eq 443
deny tcp any host <f5os-mgmt-ip> eq 443
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
