CVE-2025-61955CWE-95

CVE-2025-61955

High · published October 15, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
14.9
In the wild
Unconfirmed
What it is

⚡ An authenticated attacker with local access can escalate privileges on F5OS-A and F5OS-C systems, potentially crossing critical security boundaries! 🔥 Think of it like a hotel guest who finds a way to bypass the front desk and access restricted floors—once they're in, they can snoop around wherever they like, which might include sensitive areas. If successfully exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive data and systems, thereby compromising not just the attacker’s own room but potentially the entire hotel’s security. This breach could have alarming consequences, leading to data theft, loss of trust, and extensive reputational damage.

Put simply

Think of it like a hotel guest who finds a way to bypass the front desk and access restricted floors—once they're in, they can snoop around wherever they like, which might include sensitive areas. This vulnerability in F5OS-A and F5OS-C allows authenticated users with local access to elevate their privileges, effectively bypassing security measures that should keep sensitive areas secure.

What to do

If successfully exploited, this vulnerability could allow attackers to gain unauthorized access to sensitive data and systems, thereby compromising not just the attacker’s own room but potentially the entire hotel’s security. This breach could have alarming consequences, leading to data theft, loss of trust, and extensive reputational damage. To mitigate this risk, ensure you upgrade to the latest secure version of F5OS-A or F5OS-C, implement strict local access controls, and regularly audit user permissions to prevent unauthorized privilege escalation. You've got this! By following these steps, you can secure your system and keep it safe from potential breaches. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00246 · 14.9th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2025-10-15T18:15Z
Affected products (4)
ProductVersionsFixed in
f5/f5os-a≥ 1.5.1, < 1.5.41.5.4
f5/f5os-aall versions—
f5/f5os-c≥ 1.6.0, ≤ 1.6.2—
f5/f5os-c≥ 1.8.0, < 1.8.21.8.2
References (1)
EPSS history
Timeline
  • 15 OCT 13:55Z
    F5OS vulnerability
    cvelistv5