Login Request a demo
Medium severity · published May 7, 2025
CVE-2025-43878
When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing…
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing system diagnostics tcpdump command utility on a F5OS-C/A system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
F5
F5os-a · F5
1.5.1 before 1.8.0 · source: NVD
F5
F5os-c · F5
1.6.0 through 1.6.2 · source: NVD
Affected product
F5
F5os-a
F5
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-43878
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-43878
Vendor Advisory
https://my.f5.com/manage/s/article/K000139502
More from F5os-a
8.8
CVE-2025-57780
A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges.  A successful exploit may allow the…
8.8
CVE-2025-61955
A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges.  A successful exploit may allow the…
8.8
CVE-2025-46265
On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may be authorized with higher privilege F5OS roles. Note:…
8.8
CVE-2022-41835
F5OS vulnerability CVE-2022-41835
8.1
CVE-2025-36546
On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; access via SSH key-based…