Cyber Resilience

CVE-2025-43878

High

Published: 07 May 2025

Published
07 May 2025
Modified
07 November 2025
KEV Added
—
Patch
—
CVSS Score v4 8.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0014 33.6th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-43878 is a high-severity Improper Neutralization of Quoting Syntax (CWE-149) vulnerability in F5 F5Os-A. Its CVSS base score is 8.3 (High).

Operationally, ranked at the 33.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may be able to bypass Appliance mode restrictions utilizing system diagnostics tcpdump command utility on a F5OS-C/A system. Note: Software versions which have reached End…

more

of Technical Support (EoTS) are not evaluated.

CWE(s)
CWE-149CWE-1286

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

f5
f5os-a
1.5.1 — 1.8.0
f5
f5os-c
1.6.0 — 1.6.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References