CVE Alert: CVE-2025-57780 – F5 – F5OS – Appliance

Risk verdict

High risk due to local, authenticated privilege escalation capable of crossing security boundaries; no active exploitation is indicated at present.

Why this matters

An attacker with local access can elevate privileges to system-wide control, undermining confidentiality, integrity and availability. In practical terms, a compromised maintenance or on-site operator session could lead to administrator-level changes, deployment disruption or exposure of sensitive data across affected appliances.

Most likely attack path

Exploitation is feasible with local access and low privileges required, and no user interaction needed. An attacker who already has foothold on the device can escalate to administrator rights, potentially affecting the entire system scope. Lateral movement is contingent on local access channels rather than remote exploitation, increasing risk for on-site support and maintenance scenarios.

Who is most exposed

Deployments of F5OS-A and F5OS-C in on-prem data centres or edge/branch sites with maintenance consoles are most at risk; devices that are in End of Technical Support or not in active patch cycles are particularly sensitive.

Detection ideas

• Unauthorised elevation of privileges or new admin accounts
• Sudden changes to local policy,sudoers, or security boundaries
• Unusual or new privileged processes, kernel or system calls
• Suspicious modification of access logs for maintenance windows
• Anomalous console or SSH activity from maintenance stations

Mitigation and prioritisation

• Patch to latest supported release; verify vendor guidance and lifecycle status
• Enforce strict local-access controls; disable unused management interfaces
• Apply MFA and strict role-based access for maintenance consoles
• Implement network segmentation and monitoring around management paths
• If KEV is present or EPSS ≥ 0.5, treat as priority 1; otherwise prioritise as High and schedule in the next patch cycle
• Document change-management steps and test in a staging environment before production rollout