CVE-2025-59778 in F5OS-C
Summary
by MITRE • 10/15/2025
When the Allowed IP Addresses feature is configured on the F5OS-C partition control plane, undisclosed traffic can cause multiple containers to terminate.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/31/2025
The vulnerability identified as CVE-2025-59778 represents a critical stability issue within the F5OS-C partition control plane environment where the Allowed IP Addresses feature is implemented. This flaw manifests when specific undisclosed traffic patterns interact with the system's containerized infrastructure, leading to unexpected termination of multiple containers. The vulnerability specifically targets the control plane components of F5OS-C, which serve as the management and configuration interface for F5 BIG-IP systems, making it particularly concerning for network security operations.
The technical root cause of this vulnerability lies in the improper handling of network traffic within the Allowed IP Addresses configuration mechanism. When certain types of traffic that are not explicitly defined or documented as part of the normal operational flow reach the control plane, the system fails to process these packets gracefully. This failure results in a cascading effect where multiple containers within the F5OS-C environment become unstable and terminate unexpectedly. The containers that terminate include critical system processes responsible for network management, configuration handling, and security policy enforcement, fundamentally compromising the system's operational integrity.
From an operational impact perspective, this vulnerability presents significant risks to network availability and security posture. The termination of multiple containers can result in complete service disruption for the F5 BIG-IP system, as essential management functions become unavailable. Network administrators lose the ability to configure, monitor, or manage the system effectively, creating potential security gaps and operational downtime. The vulnerability's classification aligns with CWE-665: Improper Initialization and CWE-400: Uncontrolled Resource Consumption, as the system fails to properly initialize or handle resource allocation when encountering unexpected traffic patterns.
The attack surface for this vulnerability is particularly concerning as it can be triggered through network traffic that is not necessarily malicious in nature, but rather represents legitimate network operations that fall outside the expected traffic patterns. This means that routine network activities, system maintenance operations, or even normal user interactions could inadvertently trigger the container termination sequence. The vulnerability demonstrates characteristics consistent with ATT&CK technique T1499.004: Endpoint Termination, where adversaries might exploit system instability to disrupt services, though in this case the trigger is an unintended side effect rather than deliberate exploitation.
Mitigation strategies for CVE-2025-59778 should focus on immediate system hardening and monitoring implementation. Organizations should ensure they are running supported versions of F5OS-C that have received patches addressing this specific container termination issue. Network segmentation and traffic filtering should be implemented to restrict access to the control plane to only explicitly trusted IP addresses and protocols. Additionally, implementing comprehensive monitoring solutions that can detect container termination events and alert administrators to potential exploitation attempts is crucial. The implementation of redundant management interfaces and automated failover mechanisms can help maintain system availability during potential exploitation attempts. Regular security assessments and vulnerability scanning should be conducted to identify similar issues within the broader F5 BIG-IP ecosystem, ensuring that the network infrastructure maintains its security posture against both known and emerging threats.