How severe is CVE-2025-60013?

CVE-2025-60013 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2025-60013 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-60013?

CVE-2025-60013 primarily affects F5 F5os-a. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2025-60013?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-60013 have an EU (EUVD) identifier?

Yes. CVE-2025-60013 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34635.

When was CVE-2025-60013 published?

CVE-2025-60013 was published on 2025-10-15 and last updated on 2026-06-17.

CVE-2025-60013

CVE-2025-60013 is a medium-severity vulnerability in F5 F5os-a with a CVSS 3.x base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-78.

Key facts

Severity: Medium (CVSS 3.x base score 4.6)
CVSS v4: 4.6
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-34635
Weakness: CWE-78
Affected product: F5 F5os-a
Published: 2025-10-15
Last modified: 2026-06-17

Description

When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module (HSM) may fail to initialize. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Frequently asked questions

What is CVE-2025-60013?: When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module (HSM) may fail to initialize. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
How severe is CVE-2025-60013?: CVE-2025-60013 has a CVSS 3.x base score of 4.6, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2025-60013 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-60013?: CVE-2025-60013 primarily affects F5 F5os-a. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2025-60013?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-60013 have an EU (EUVD) identifier?: Yes. CVE-2025-60013 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-34635.
When was CVE-2025-60013 published?: CVE-2025-60013 was published on 2025-10-15 and last updated on 2026-06-17.

References

https://my.f5.com/manage/s/article/K000154661

Affected products (2)

cpe:2.3:o:f5:f5os-a:*:*:*:*:*:*:*:*
cpe:2.3:o:f5:f5os-a:1.8.0:*:*:*:*:*:*:*

More vulnerabilities in F5 F5os-a

CVE-2025-57780 — High (CVSS 8.8): A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to…
CVE-2025-61955 — High (CVSS 8.8): A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to…
CVE-2025-46265 — High (CVSS 8.8): On F5OS, an improper authorization vulnerability exists where remotely authenticated users (LDAP, RADIUS, TACACS+) may…
CVE-2025-36546 — High (CVSS 8.1): On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based…
CVE-2002-20001 — High (CVSS 7.5): The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that…
CVE-2022-41835 — High (CVSS 7.3): In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.5.0, excessive file permissions in F5OS allows an…

All CVEs affecting F5 F5os-a →

Other CWE-78 (OS Command Injection) vulnerabilities

CVE-2026-19188 — Critical (CVSS 10.0): A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The…
CVE-2026-48362 — Critical (CVSS 10.0): ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')…
CVE-2026-16812 — Critical (CVSS 10.0): VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access…
CVE-2026-6516 — Critical (CVSS 10.0): Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to…
CVE-2026-46339 — Critical (CVSS 10.0): 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect…
CVE-2026-59726 — Critical (CVSS 10.0): Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment…

Browse all CWE-78 (OS Command Injection) vulnerabilities →