Introduction
Privilege escalation on F5OS-A and F5OS-C can undermine the isolation and trust boundaries that enterprise and service provider networks depend on. CVE-2025-61955, disclosed in October 2025, lets an authenticated attacker with local access bypass Appliance mode and gain elevated privileges on F5's next-generation platforms.
F5 Networks is a major application delivery and network security vendor. Its BIG-IP and F5OS platforms run in thousands of enterprise and service provider environments worldwide. F5OS-A powers rSeries appliances, and F5OS-C is the foundation for VELOS chassis systems. Organizations rely on these platforms for high-performance, multi-tenant, and virtualized network services.
Technical Information
CVE-2025-61955 is a privilege escalation vulnerability in the F5OS-A and F5OS-C operating systems. An authenticated user with local access can escalate their privileges and cross security boundaries, including the restrictions that Appliance mode imposes.
- Root Cause: The vulnerability is classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code, also known as eval injection). Eval injection happens when code evaluation functions (such as
eval) process user-supplied input without enough sanitization or validation. An attacker can then inject malicious directives that run with elevated privileges. - Attack Vector: The attacker needs local authenticated access. Once they have it, attack complexity is low. The vulnerability is not remotely exploitable without prior credential compromise or local access.
- Scope: Successful exploitation lets an attacker cross security boundaries within F5OS, including Appliance mode, which is meant to restrict privileged operations.
- CVSS Details:
- CVSS v3.1 Base Score: 8.8 (High) for Appliance mode
- Vector: AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
As of this writing, no public code snippets, PoC, or exploit scripts are available. The vulnerability is present only in supported versions. F5 does not evaluate End of Technical Support (EoTS) versions.
Affected Systems and Versions
- Products: F5OS-A (for rSeries appliances) and F5OS-C (for VELOS chassis)
- Version Information:
- The vulnerability is present in supported versions of F5OS-A and F5OS-C. The public advisory does not list specific version numbers. The October 2025 Quarterly Security Notification and F5 article K000156771 give the authoritative list of affected and fixed versions.
- F5 does not evaluate End of Technical Support (EoTS) versions, so they may or may not be vulnerable.
- Configuration:
- Both standard and Appliance mode configurations are affected. The CVSS score is higher for Appliance mode because of the security boundary bypass.
Vendor Security History
F5 Networks has disclosed several privilege escalation and Appliance mode bypass vulnerabilities in 2025, including CVE-2025-61955, CVE-2025-57780, and CVE-2025-61958. Also in 2025, F5 suffered a major breach by nation-state actors, who stole source code and vulnerability data. F5 typically publishes quarterly security notifications and has a history of releasing patches on time. The recent breach has prompted increased scrutiny and emergency directives from CISA for federal agencies.
