How severe is CVE-2025-60013?

CVE-2025-60013 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-60013 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-60013?

CVE-2025-60013 primarily affects F5 F5os-a. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-60013?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-60013 have an EU (EUVD) identifier?

Yes. CVE-2025-60013 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34635.

When was CVE-2025-60013 published?

CVE-2025-60013 was published on 2025-10-15 and last updated on 2026-06-17.

CVE-2025-60013

CVE-2025-60013 is a medium-severity vulnerability in F5 F5os-a with a CVSS 3.x base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-78.

Key facts

Severity: Medium (CVSS 3.x base score 4.6)
CVSS v4: 4.6
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-34635
Weakness: CWE-78
Affected product: F5 F5os-a
Published: 2025-10-15
Last modified: 2026-06-17

Description

When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module (HSM) may fail to initialize. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Frequently asked questions

What is CVE-2025-60013?: When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module (HSM) may fail to initialize. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
How severe is CVE-2025-60013?: CVE-2025-60013 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-60013 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-60013?: CVE-2025-60013 primarily affects F5 F5os-a. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-60013?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-60013 have an EU (EUVD) identifier?: Yes. CVE-2025-60013 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34635.
When was CVE-2025-60013 published?: CVE-2025-60013 was published on 2025-10-15 and last updated on 2026-06-17.

References

https://my.f5.com/manage/s/article/K000154661

Affected products (2)

cpe:2.3:o:f5:f5os-a:*:*:*:*:*:*:*:*
cpe:2.3:o:f5:f5os-a:1.8.0:*:*:*:*:*:*:*

More vulnerabilities in F5 F5os-a

CVE-2025-57780 — High (CVSS 8.8): A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to…
CVE-2025-61955 — High (CVSS 8.8): A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to…
CVE-2025-46265 — High (CVSS 8.8): On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may…
CVE-2025-36546 — High (CVSS 8.1): On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based…
CVE-2002-20001 — High (CVSS 7.5): The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that…
CVE-2022-41835 — High (CVSS 7.3): In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an…

All CVEs affecting F5 F5os-a →

Other CWE-78 (OS Command Injection) vulnerabilities

CVE-2026-56004 — Critical (CVSS 10.0): A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by…
CVE-2026-56415 — Critical (CVSS 10.0): Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is…
CVE-2026-56413 — Critical (CVSS 10.0): Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens…
CVE-2026-49869 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in…
CVE-2026-49261 — Critical (CVSS 10.0): MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through…
CVE-2026-10520 — Critical (CVSS 10.0): An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a…

Browse all CWE-78 (OS Command Injection) vulnerabilities →