F5OS Improper Authorization Vulnerability Allowing Privilege Escalation

An improper authorization vulnerability has been identified in F5OS, where remotely authenticated users via LDAP, RADIUS, or TACACS+ can be granted higher privilege roles than intended. This vulnerability affects F5OS versions 1.5.1, as well as 1.6.0 through 1.6.2.

Impact

Exploitation of this vulnerability may lead to a remote, authenticated user being granted elevated privileges, such as the F5OS admin role.

Remediation

Users can upgrade to F5OS version 1.8.0 or 1.5.2 to address this vulnerability. For F5OS-C, the engineering hotfix is available for download from the MyF5 Downloads page.