Medium severity · published May 7, 2025
CVE-2025-43878
F5OS-A/C CLI vulnerability
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing system diagnostics tcpdump command utility on a F5OS-C/A system.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
F5OS - Appliance · F5
1.5.1 before 1.8.0 · source: vendor
FC
F5OS - Chassis · F5
1.6.0 before 1.8.0 · source: vendor
F5
F5os-a · F5
1.5.1 before 1.8.0 · source: NVD
F5
F5os-c · F5
1.6.0 through 1.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-43878
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-43878
Vendor Advisory
https://my.f5.com/manage/s/article/K000139502
More from F5OS - Appliance
8.8
CVE-2025-57780
F5OS Vulnerability
8.8
CVE-2025-61955
F5OS vulnerability
8.8
CVE-2025-46265
F5OS vulnerability
8.1
CVE-2025-36546
F5OS Appliance Mode vulnerability
6.5
CVE-2025-47150
F5OS SNMP vulnerability