Improper Authorization Vulnerability in F5OS by F5 Networks
CVE-2025-46265

8.7HIGH

Key Information:

Vendor

F5
Status
F5os - Appliance
F5os - Chassis
Vendor
CVE Published:
7 May 2025

What is CVE-2025-46265?

An improper authorization vulnerability has been identified in F5OS, where remotely authenticated users, through protocols such as LDAP, RADIUS, and TACACS+, can gain unauthorized access to higher-privilege roles within the system. This could potentially allow these users to perform actions beyond their intended permissions, posing security risks to sensitive data and operational integrity. Users are urged to update their systems to maintain security posture, especially for versions that have not reached End of Technical Support (EoTS).

Affected Version(s)

F5OS - Appliance 1.7.0 < 1.8.0

F5OS - Appliance 1.5.1 < 1.5.2

F5OS - Chassis 1.6.0 < 1.8.0

References

https://my.f5.com/manage/s/article/K000139503
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5
.
CVE-2025-46265 : Improper Authorization Vulnerability in F5OS by F5 Networks