CVE-2025-61955: F5 F5OS-A Privilege Escalation Flaw

CVE-2025-61955 Overview

CVE-2025-61955 is a local privilege escalation vulnerability affecting F5OS-A and F5OS-C systems. An authenticated attacker with local access can escalate privileges and cross a security boundary within the affected appliance operating systems. F5 assigned this issue a CVSS 4.0 base score of 8.5, reflecting high impact to confidentiality, integrity, and availability of the vulnerable component. The Common Weakness Enumeration classifies the root cause under [CWE-95], improper neutralization of directives in dynamically evaluated code (eval injection). Software versions that have reached End of Technical Support (EoTS) were not evaluated by the vendor.

Critical Impact
Authenticated local users can escalate privileges on F5OS-A and F5OS-C appliances, breaching platform security boundaries and gaining unauthorized access to system resources.

Affected Products

F5 F5OS-A (including version 1.8.0)
F5 F5OS-C
Non-EoTS versions of both platforms as documented in the vendor advisory

Discovery Timeline

2025-10-15 - CVE-2025-61955 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61955

Vulnerability Analysis

CVE-2025-61955 affects F5OS-A and F5OS-C, the appliance and chassis operating systems that underpin F5 rSeries and VELOS hardware platforms. The flaw enables an authenticated local user to escalate privileges beyond their assigned role. Because F5OS mediates management of tenants, blades, and platform services, a privilege boundary crossing exposes administrative functions that should be isolated from lower-privileged accounts.

Exploitation requires prior authentication and local access, meaning an attacker must already possess valid credentials on the appliance shell or management interface. The attack complexity is low and no user interaction is required, which increases exposure once initial access is obtained. The vulnerability score reflects high impact on confidentiality, integrity, and availability of the vulnerable component, without spread to subsequent systems.

Root Cause

The underlying weakness maps to [CWE-95], improper neutralization of directives in dynamically evaluated code. This category covers cases where user-controllable input reaches a code evaluation function without adequate sanitization. In this context, an attacker supplies crafted input that the platform interprets as executable instructions, running them in a higher-privileged execution context.

Attack Vector

The attack vector is local and requires low privileges. An authenticated user with shell or restricted management access provides malicious input to a component that dynamically evaluates it. The evaluated payload executes with elevated privileges, allowing the attacker to cross the security boundary between tenant, operator, or admin roles. F5 has not published exploitation details, and no public proof-of-concept is currently available.

See the F5 Support Article K000156771 for the vendor-supplied technical description and affected version matrix.

Detection Methods for CVE-2025-61955

Indicators of Compromise

Unexpected shell commands or scripts executed by non-administrative F5OS accounts under root or higher-privilege contexts.
New or modified system accounts, SSH keys, or sudoers entries added outside of change windows.
Anomalous entries in F5OS audit logs showing role transitions or privilege changes for non-admin users.
Configuration changes to tenants, blades, or platform services initiated by accounts lacking those permissions.

Detection Strategies

Forward F5OS platform and audit logs to a centralized SIEM and alert on privilege elevation events and command execution by low-privileged roles.
Baseline expected administrative activity per account and flag deviations, particularly interactive shell commands from operator or read-only users.
Monitor authentication logs for local logins followed by unusual process execution or configuration changes within short time windows.

Monitoring Recommendations

Enable verbose audit logging on F5OS management planes and retain logs for forensic review.
Continuously monitor local account inventories and privilege assignments on rSeries and VELOS appliances.
Correlate F5OS events with identity provider logs to detect credential misuse leading to local access.

How to Mitigate CVE-2025-61955

Immediate Actions Required

Review the F5 Support Article K000156771 and identify affected F5OS-A and F5OS-C versions in your environment.
Apply the fixed F5OS release specified by F5 as soon as maintenance windows allow.
Audit local accounts on F5OS appliances and remove or disable unused credentials with shell or management access.
Rotate credentials for any account that may have been used to test or exploit this issue.

Patch Information

F5 documents fixed versions and upgrade guidance in the vendor advisory F5 Support Article K000156771. Administrators should upgrade F5OS-A and F5OS-C to the remediated releases listed by the vendor. Versions that have reached End of Technical Support are not evaluated and should be migrated to a supported release.

Workarounds

Restrict local and management access to F5OS appliances to a limited set of trusted administrators pending patch deployment.
Enforce strong authentication, including multi-factor authentication where supported, on all F5OS management interfaces.
Segment management networks so that only authorized bastion hosts can reach F5OS SSH and API endpoints.
Increase log review frequency and alert on privilege boundary events until upgrades are complete.

bash

# Example: restrict SSH access to F5OS management interface
# Applied on upstream firewall or jump host access control
allow from 10.10.20.0/24 to f5os-mgmt tcp/22
deny  from any        to f5os-mgmt tcp/22