TI-2025-34563 Aliases CVE-2025-54809 GHSA-gqx9-9g2r-r86m

F5 Access for Android vulnerability

LOW 38CWE-295Published 2025-08-13 · Updated 2025-08-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: High
Attack requirements: None
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

F5 Access for Android before version 3.1.2 which uses HTTPS does not verify the remote endpoint identity. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00274 19th percentileScored 2026-11-07

Fix Fixed F5 Access (F5): 3.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
F5	F5 Access	3.1.0 to before 3.1.2	3.1.2	Patch available	CNA

F5 Access VendorF5 Affected 3.1.0 to before 3.1.2 Fixed in 3.1.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:f5:f5_access::::::android::*	3.1.0 to before 3.1.2	Vulnerable	F5

cpe:2.3:a:f5:f5_access:*:*:*:*:*:android:*:* Versions 3.1.0 to before 3.1.2 Vulnerable ·F5

Remediation

Fix · CNA F5 Access (F5) Fixed in 3.1.2

Timeline

2026-10-02 Threatist record created from CVE-2025-54809
2026-10-03 Alias added: GHSA-gqx9-9g2r-r86m

References

Advisory 1

https://my.f5.com/manage/s/article/K000152049

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences