CVE-2025-36546

Appliance Mode in F5OS systems is designed to restrict administrative access and block direct access to the system shell. However, if the root user previously configured key-based SSH authentication, this mechanism remains active after switching the system to Appliance Mode, contrary to the mode's intended behavior. An attacker who obtains the root user's private SSH key can log into the system while bypassing Appliance Mode restrictions. The vulnerability is classified as CWE-863 (improper authorization).

An attacker possessing the root user's private SSH key can gain full access to the F5OS system with root privileges, bypassing the restrictions imposed by Appliance Mode. This can lead to device takeover, breach of data confidentiality and integrity, and service unavailability.

Apply patches available from the vendor in accordance with the references (F5 article K000140574). Additionally, it is recommended to verify and remove authorized SSH keys of the root user on systems with Appliance Mode enabled, and to restrict access to the root user's private SSH keys.

F5OS systems running on F5OS-C and F5OS-A platforms where the root user had previously configured public key SSH authentication and subsequently Appliance Mode was enabled. Specific versions are indicated in the vendor references (K000140574). Versions that have reached End of Technical Support (EoTS) are not included in the assessment.