CVE-2025-57780

HighCVSS 8.8/10Last modified Oct 18, 2026

Description

A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalate their privileges. A successful exploit may allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-250

Affected software

Vendor	Product	Versions
F5	F5OS - Appliance	>= 1.8.0, < 1.8.3; >= 1.5.0, < 1.5.4
F5	F5OS - Chassis	>= 1.8.0, < 1.8.2; >= 1.6.0, < 1.6.4

References

https://my.f5.com/manage/s/article/K000156771Vendor Advisory

Timeline

Published: Oct 15, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-577818.4The installers of DENSO TEN drive recorder viewer contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Li CVE-2025-577835.3Improper header parsing may lead to request smuggling has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated CVE-2025-577843.3Tomahawk auth timing attack due to usage of `strcmp` has been identified in Hiawatha webserver version 11.7 which allows a local attacker to CVE-2025-577856.5A Double Free in XSLT `show_index` has been identified in Hiawatha webserver version 11.7 which allows an unauthenticated attacker to corrup CVE-2025-577865.4A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. A specia CVE-2025-577876.1A reflected cross-site scripting (xss) vulnerability exists in the modifyRoute functionality of MedDream PACS Premium 7.3.6.870. A specially CVE-2025-577886.5A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC he CVE-2025-577895.4During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain CVE-2025-57797.5A vulnerability has been found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this vulnerabil CVE-2025-577908.8A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversa CVE-2025-577916.5A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal CVE-2025-5779210.0Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web appl