F5 Networks F5os A
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in F5 Networks F5os A.
Recent F5 Networks F5os A Security Advisories
| Advisory | Title | Published |
|---|---|---|
| K000140574 | K000140574: F5OS Appliance Mode vulnerability CVE-2025-36546 | May 9, 2025 |
By the Year
In 2026 there have been 0 vulnerabilities in F5 Networks F5os A. F5os A did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 2 | 5.50 |
| 2023 | 2 | 6.10 |
| 2022 | 3 | 6.53 |
| 2021 | 1 | 7.50 |
It may take a day or so for new F5os A vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent F5 Networks F5os A Security Vulnerabilities
F5OS LDAP Auth Bypass for Unassigned Users
CVE-2024-24966
5.5 - Medium
- February 14, 2024
When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
AuthZ
Directory Traversal in F5OS QKView Utility (CVE-2024-23607)
CVE-2024-23607
5.5 - Medium
- February 14, 2024
A directory traversal vulnerability exists in the F5OS QKView utility that allows an authenticated attacker to read files outside the QKView directory. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Directory traversal
CVE-2023-36494: Audit Log Info Exposure on F5OS-A
CVE-2023-36494
4.4 - Medium
- August 02, 2023
Audit logs on F5OS-A may contain undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Insertion of Sensitive Information into Log File
F5OS-A/C Command Injection via Tenant File Names (v1.2.x-1.3.x / v1.3.x-1.5.x)
CVE-2023-22657
7.8 - High
- February 01, 2023
On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for command injection. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Command Injection
Dir Traversal in F5OS CLI <1.1.0 (A) & <1.4.0 (C)
CVE-2022-41780
5.5 - Medium
- October 19, 2022
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI that allows an attacker to read arbitrary files.
Directory traversal
F5OS: Auth Local Exec via Excessive File Perms in F5OS-A<1.1, F5OS-C<1.5
CVE-2022-41835
8.8 - High
- October 19, 2022
In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an authenticated local attacker to execute limited set of commands in a container and impact the F5OS controller.
Improper Privilege Management
On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally
CVE-2022-25990
5.3 - Medium
- May 05, 2022
On 1.0.x versions prior to 1.0.1, systems running F5OS-A software may expose certain registry ports externally. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Information Disclosure
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers
CVE-2002-20001
7.5 - High
- November 11, 2021
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
Resource Exhaustion
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for F5 Networks F5os A or by F5 Networks? Click the Watch button to subscribe.
