CVE-2025-54809
📋 TL;DR
F5 Access for Android before version 3.1.2 fails to verify remote endpoint identity during HTTPS connections, allowing man-in-the-middle attacks. This affects Android users running vulnerable versions of the F5 Access VPN client. Attackers could intercept and manipulate VPN traffic.
💻 Affected Systems
- F5 Access for Android
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete interception of all VPN traffic, credential theft, session hijacking, and injection of malicious content into encrypted communications.
Likely Case
Man-in-the-middle attackers intercepting sensitive corporate data, credentials, or session tokens transmitted through the VPN connection.
If Mitigated
Limited impact if network controls prevent man-in-the-middle positioning or if traffic is additionally encrypted at application layer.
🎯 Exploit Status
Exploitation requires man-in-the-middle positioning between client and VPN endpoint. No authentication bypass needed once MITM is established.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.2
Vendor Advisory: https://my.f5.com/manage/s/article/K000152049
Restart Required: Yes
Instructions:
1. Open Google Play Store on Android device. 2. Search for 'F5 Access'. 3. Update to version 3.1.2 or later. 4. Restart the F5 Access application.
🔧 Temporary Workarounds
Disable vulnerable app
androidTemporarily disable or uninstall F5 Access until patched
Settings > Apps > F5 Access > Disable/Uninstall
Use alternative VPN client
allUse F5 Access for iOS or desktop versions if available
🧯 If You Can't Patch
- Restrict VPN access to trusted networks only (avoid public Wi-Fi)
- Implement additional application-layer encryption for sensitive data
🔍 How to Verify
Check if Vulnerable:
Check F5 Access app version in Android Settings > Apps > F5 AccessCheck Version:
Not applicable - check via Android UIVerify Fix Applied:
Confirm version is 3.1.2 or higher in app settings📡 Detection & Monitoring
Log Indicators:
- Unexpected certificate warnings in client logs
- Connection failures with certificate validation errors
Network Indicators:
- Unusual MITM activity on VPN connection paths
- SSL/TLS interception attempts
SIEM Query:
source="android_device" app="F5 Access" (event="certificate_error" OR event="ssl_handshake_failure")