CVE-2025-36546: F5OS Appliance Mode vulnerability
On an F5OS system, if the root user configures the system to allow login using SSH key-based authentication and later enables appliance mode, the system still allows access using SSH key-based authentication. For an attacker to exploit this vulnerability they must obtain possession of a private key corresponding to a previously-configured entry in root's SSH authorizedkeys file.
Other sources
On an F5OS system, if the root user had previously configured the system to allow login via SSH key-based authentication, and then enabled Appliance Mode; access via SSH key-based authentication is still allowed. For an attacker to exploit this vulnerability they must obtain the root user's SSH private key.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-36546?
CVE-2025-36546 is classified as a high-severity vulnerability due to the potential unauthorized SSH access it allows.
How do I fix CVE-2025-36546?
To mitigate CVE-2025-36546, disable SSH key-based authentication for root users when appliance mode is enabled.
What systems are affected by CVE-2025-36546?
CVE-2025-36546 affects F5 F5OS-A versions from 1.5.1 to 1.5.2 and F5 F5OS-C versions from 1.6.0 to 1.6.2.
What is the impact of CVE-2025-36546?
If exploited, CVE-2025-36546 allows attackers with access to the private key to gain unauthorized SSH access to the F5OS system.
Who is responsible for fixing CVE-2025-36546 in affected systems?
It is the responsibility of system administrators to implement the necessary configurations to mitigate CVE-2025-36546.