CVE-2025-43878

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-43878

6.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

W

hen running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing system diagnostics tcpdump command utility on a F5OS-C/A system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References
Link Resource
https://my.f5.com/manage/s/article/K000139502 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:f5:f5os-a:*:*:*:*:*:*:*:*
cpe:2.3:o:f5:f5os-c:*:*:*:*:*:*:*:*
OR cpe:2.3:h:f5:r10600:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r10800:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r10900:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r12600-ds:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r12800-ds:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r12900-ds:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r5600:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r5800:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r5900:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:velos_cx1610:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:velos_cx410:-:*:*:*:*:*:*:*
History

07 Nov 2025, 16:54

Type Values Removed Values Added
CPE cpe:2.3:o:f5:f5os-c:*:*:*:*:*:*:*:*
cpe:2.3:h:f5:velos_cx410:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r10600:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r5600:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r12600-ds:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r5900:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r10900:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r10800:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r12900-ds:-:*:*:*:*:*:*:*
cpe:2.3:o:f5:f5os-a:*:*:*:*:*:*:*:*
cpe:2.3:h:f5:velos_cx1610:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r12800-ds:-:*:*:*:*:*:*:*
cpe:2.3:h:f5:r5800:-:*:*:*:*:*:*:*
References () https://my.f5.com/manage/s/article/K000139502 - () https://my.f5.com/manage/s/article/K000139502 - Vendor Advisory
First Time F5 r10800
F5 velos Cx1610
F5 r5900
F5 r10600
F5
F5 r10900
F5 f5os-a
F5 r12600-ds
F5 r5800
F5 velos Cx410
F5 r12800-ds
F5 r12900-ds
F5 r5600
F5 f5os-c

08 May 2025, 14:39

Type Values Removed Values Added
Summary
  • (es) Al ejecutarse en modo Dispositivo, un atacante autenticado con el rol de Administrador o Administrador de Recursos podría eludir las restricciones del modo Dispositivo mediante la utilidad de diagnóstico del sistema tcpdump en un sistema F5OS-C/A. Nota: Las versiones de software que han alcanzado el fin del soporte técnico (EoTS) no se evalúan.

07 May 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-07 22:15

Updated : 2025-11-07 16:54

NVD link : CVE-2025-43878

Mitre link : CVE-2025-43878

CVE.ORG link : CVE-2025-43878

JSON object : View

Products Affected

f5

CWE
CWE-149

Improper Neutralization of Quoting Syntax

CWE-1286

Improper Validation of Syntactic Correctness of Input