Introduction
CVE-2025-53868 shows that even a highly restricted administrative mode like F5 BIG-IP Appliance mode can be bypassed by an attacker with the right combination of access and privilege. In enterprise environments, that could undermine critical security controls.
F5 Networks is a major vendor in the application delivery and security market, and its BIG-IP platform is widely deployed for load balancing, application security, and traffic management. Appliance mode is a security feature that restricts administrative access and command execution to reduce risk in sensitive deployments.
Technical information
CVE-2025-53868 is a vulnerability in F5 BIG-IP systems running in Appliance mode. With Appliance mode enabled, administrative users cannot access the root account or execute arbitrary system commands. The aim is a more appliance-like security posture.
A highly privileged authenticated attacker with access to SCP and SFTP can bypass these Appliance mode restrictions using undisclosed commands. The root cause is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command, also known as OS Command Injection). That classification suggests the flaw involves insufficient sanitization of input or command parameters processed by the SCP and SFTP subsystems, which would let attackers execute commands outside the intended security boundaries.
No public code snippets or specific exploitation details are available. The attack requires both high privilege and protocol access, which limits the attack surface. If an insider or an attacker with compromised credentials exploited it, though, the consequences could be severe.
Affected systems and versions
- Product: F5 BIG-IP (Appliance mode)
- Vulnerable configurations: Systems running in Appliance mode where highly privileged authenticated users have SCP and SFTP access
- Only supported software versions are evaluated. Versions that have reached End of Technical Support (EoTS) are not evaluated and may or may not be affected.
Vendor security history
F5 Networks has previously addressed similar vulnerabilities in BIG-IP Appliance mode, including:
- CVE-2025-31644: Command injection in Appliance mode, allowing privilege escalation via iControl REST API and tmsh save command
- CVE-2025-61958: Appliance mode bypass by authenticated attackers with resource administrator privileges
F5 publishes security notifications on a quarterly schedule and provides patches for supported versions. The company does not evaluate or patch versions that have reached End of Technical Support (EoTS), so customers need to keep their systems updated.
