CVE-2025-54809: F5 Access Auth Bypass Vulnerability

CVE-2025-54809 Overview

CVE-2025-54809 affects F5 Access for Android before version 3.1.2. The application uses HTTPS but fails to verify the remote endpoint identity. This improper certificate validation flaw [CWE-295] allows attackers positioned on the network to impersonate trusted F5 Access endpoints. The vulnerability enables man-in-the-middle (MITM) attacks against mobile VPN clients connecting to F5 BIG-IP infrastructure. Successful exploitation can expose authentication credentials, session tokens, and tunneled corporate traffic. F5 published advisory K000152049 to address the issue. Software versions that have reached End of Technical Support (EoTS) are not evaluated for this advisory.

Critical Impact
Network-positioned attackers can intercept VPN traffic and harvest enterprise credentials by impersonating F5 Access endpoints due to missing TLS certificate validation.

Affected Products

F5 Access for Android versions prior to 3.1.2
Android mobile devices running vulnerable F5 Access client
Enterprise deployments using F5 BIG-IP APM with F5 Access mobile clients

Discovery Timeline

2025-08-13 - CVE-2025-54809 published to NVD
2025-08-13 - F5 advisory K000152049 published
2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-54809

Vulnerability Analysis

F5 Access for Android is a mobile VPN client that establishes secure tunnels to F5 BIG-IP Access Policy Manager (APM) gateways. The client uses HTTPS for control-channel communication with the remote endpoint. Versions before 3.1.2 do not validate the identity presented by the remote server during the TLS handshake. The client accepts certificates that do not chain to a trusted root, do not match the expected hostname, or are otherwise invalid.

This weakness maps to [CWE-295] Improper Certificate Validation. The flaw breaks the authentication guarantee that HTTPS is designed to provide. Attackers can substitute their own certificate for the legitimate F5 gateway certificate without raising errors in the client.

Root Cause

The root cause is missing or incorrect certificate verification logic in the F5 Access for Android TLS implementation. Proper TLS clients must validate the certificate chain, expiration, hostname, and revocation status. The affected versions skip one or more of these checks, accepting attacker-controlled certificates as valid.

Attack Vector

Exploitation requires a network position that allows traffic interception, such as a hostile Wi-Fi network, compromised upstream router, or rogue access point. The attack also requires user interaction (UI:P), typically the user launching the F5 Access client. Once the user initiates a connection, the attacker presents a forged TLS certificate. The vulnerable client completes the handshake without verifying the endpoint identity. The attacker then proxies traffic between the client and the legitimate F5 gateway, observing or modifying credentials, session cookies, and tunneled application data. Refer to the F5 Article K000152049 for vendor-supplied details.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in CISA KEV.

Detection Methods for CVE-2025-54809

Indicators of Compromise

Unexpected TLS certificates presented by hosts claiming to be F5 BIG-IP APM endpoints, especially certificates not issued by the enterprise PKI
Authentication anomalies for VPN users, including logins from unusual geolocations or simultaneous sessions from different IP addresses
F5 Access client connections originating from networks outside expected user patterns

Detection Strategies

Inventory F5 Access for Android deployments and identify clients running versions earlier than 3.1.2
Monitor BIG-IP APM authentication logs for credential reuse, brute force patterns, or session token replay
Inspect network telemetry for TLS connections to F5 endpoints that terminate at unexpected intermediate hosts

Monitoring Recommendations

Enable verbose APM logging and forward authentication events to a centralized SIEM for correlation
Alert on F5 Access logins followed by access from a different source IP within a short window
Track mobile device management (MDM) compliance to confirm the patched client version is deployed across the fleet

How to Mitigate CVE-2025-54809

Immediate Actions Required

Upgrade F5 Access for Android to version 3.1.2 or later on all managed devices
Force-rotate credentials and revoke active session tokens for users who connected through vulnerable clients on untrusted networks
Distribute the patched client through enterprise mobile device management to ensure rapid coverage

Patch Information

F5 has released F5 Access for Android version 3.1.2, which implements proper remote endpoint identity verification. Administrators should consult the F5 Article K000152049 for upgrade instructions and supported platform details. Versions that have reached End of Technical Support are not patched and must be replaced with a supported release.

Workarounds

Instruct users to avoid connecting through F5 Access on untrusted networks such as public Wi-Fi until the client is updated
Enforce certificate pinning or device posture checks at the BIG-IP APM where supported
Require multi-factor authentication on APM access policies to limit the value of intercepted credentials

bash

# Verify installed F5 Access version on a managed Android device via adb
adb shell dumpsys package com.f5.edge.client_ics | grep versionName

# Expected output for patched client:
# versionName=3.1.2