CVE-2018-5538 Security feature bypass in BIG-IP (DNS)

What is CVE-2018-5538?

CVE-2018-5538 is a low-severity vulnerability in F5 Big-Ip Domain Name System, published on 25 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the 'Allow NOTIFY From' configuration parameter when the db variable "dnsexpress.notifyport" is set to any value other than the default of "0".

Which versions are affected by CVE-2018-5538?

It affects 4 products.

Products include F5 Big-Ip Domain Name System, F5 Big-Ip Global Traffic Manager, F5 Big-Ip Link Controller, F5 Big-Ip Local Traffic Manager.

How do I fix CVE-2018-5538?

No fix has been published for CVE-2018-5538 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-5538 being exploited?

There is no known exploitation of CVE-2018-5538 in the wild and no public exploit code.

Other vulnerabilities in F5 Big-Ip Domain Name System

• CVE-2022-23013 Cross-site scripting in BIG-IP DNS & GTM High 8.8
• CVE-2026-40061 iControl REST and tmsh vulnerability High 8.5
• CVE-2022-41787 BIG-IP DNS Express vulnerability CVE-2022-41787 High 7.5
• CVE-2021-23032 Denial of service in BIG-IP DNS High 7.5
• CVE-2020-27717 Denial of service in BIG-IP DNS High 7.5

All F5 Big-Ip Domain Name System vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vjx8-8j32-57mf.