CVE-2022-41780 F5OS CLI vulnerability CVE-2022-41780

Medium 5.5 Published 19 Oct 2022 Updated 8 May 2025

An attacker can read arbitrary files via a directory traversal vulnerability in the F5OS CLI, requiring an upgrade to secure the system.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-41780?

CVE-2022-41780 is a medium-severity path traversal vulnerability in F5OS-A, published on 19 Oct 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In F5OS-A version 1.x before 1.1.0 and F5OS-C version 1.x before 1.4.0, a directory traversal vulnerability exists in an undisclosed location of the F5OS CLI that allows an attacker to read arbitrary files.

Weakness: CWE-22

Which versions are affected by CVE-2022-41780?

It affects 2 products.

Products include F5 F5os-A, F5 F5os-C.

How do I fix CVE-2022-41780?

No fix has been published for CVE-2022-41780 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-41780 being exploited?

There is no known exploitation of CVE-2022-41780 in the wild and no public exploit code.

Sources

Also known as GHSA-fqrv-f4vq-33v4.