{"id":"CVE-2018-5538","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-5538","generatedAt":"2026-10-29T00:48:20.125Z","title":"On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the 'Allow NOTIFY From' configuration parameter when the db variable…","description":"On F5 BIG-IP DNS 13.1.0-13.1.0.7, 12.1.3-12.1.3.5, DNS Express / DNS Zones accept NOTIFY messages on the management interface from source IP addresses not listed in the 'Allow NOTIFY From' configuration parameter when the db variable \"dnsexpress.notifyport\" is set to any value other than the default of \"0\".","published":"2018-07-25T14:29:00.000Z","lastModified":"2026-06-17T02:00:30.000Z","status":"Modified","sourceIdentifier":"f5sirt@f5.com","cvss":{"version":"3.0","score":3.7,"severity":"LOW","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},"cwe":[],"affected":["f5/big-ip domain name system","f5/big-ip global traffic manager","f5/big-ip local traffic manager","f5/big-ip link controller"],"epss":{"score":0.00782,"percentile":0.55802,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.78%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://support.f5.com/csp/article/K45435121","tags":["Mitigation","Vendor Advisory"],"source":"f5sirt@f5.com"},{"url":"https://support.f5.com/csp/article/K45435121","tags":["Mitigation","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-5538","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}