F5 Product Security Update Advisory

Overview

 

We have released security updates to fix vulnerabilities in F5 products. Users of affected products are advised to update to the latest version.

 

 

Affected Products

 

CVE-2025-53868

 

BIG-IP (all modules) Version: 17.5.0
BIG-IP (all modules) Version: 17.1.0 or later and 17.1.2 or earlier
BIG-IP (all modules) version: 16.1.0 or later and 16.1.6 or earlier
BIG-IP (all modules) version: 15.1.0 or later and 15.1.10 or earlier

 

CVE-2025-61955, CVE-2025-57780

 

F5OS-A Version: 1.8.0
F5OS-A Version: 1.5.1 or later and 1.5.3 or earlier
F5OS-C Version: 1.8.0 or later and 1.8.1 or earlier
F5OS-C Versions: 1.6.0 or later and 1.6.2 or earlier

 

 

Resolved Vulnerabilities

 

Appliance mode restriction bypass for authenticated users in SCP and SFTP on BIG-IP (CVE-2025-53868)
Local privilege escalation vulnerability in F5OS-A and F5OS-C (CVE-2025-61955)
Local privilege escalation vulnerability in F5OS-A and F5OS-C (CVE-2025-57780)

 

 

Vulnerability Patches

vulnerability patches have been made available in the latest updates. Please follow the instructions on the Referenced Sites to update to the latest Vulnerability Patches version.

 

CVE-2025-53868

 

BIG-IP (all modules) Version: 17.5.1
BIG-IP (all modules) version: 17.1.3
BIG-IP (all modules) Version: 16.1.6.1
BIG-IP (all modules) version: 15.1.10.8

 

CVE-2025-61955, CVE-2025-57780

 

F5OS-A Version: 1.8.3
F5OS-A Version: 1.5.4
F5OS-C Version: 1.8.2
F5OS-C Version: 1.6.4

 

 

References

 

[1] K000151902: BIG-IP SCP and SFTP vulnerability CVE-2025-53868
https://my.f5.com/manage/s/article/K000151902
[2] K000156767: F5OS vulnerability CVE-2025-61955
https://my.f5.com/manage/s/article/K000156767
[3] K000156771: F5OS vulnerability CVE-2025-57780
https://my.f5.com/manage/s/article/K000156771