F5 BIG-IP DNS vulnerabilities

14 CVEs affecting F5 BIG-IP DNS, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-5501, published 2018-03-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-6164, published 2017-12-21. High severity, CVSS 8.1. EPSS: 3.9% chance of exploitation in the next 30 days. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, 12.0.0 - 12.1.2, 11.6.0 - 11.6.1 and 11.5.0 -…
CVE-2017-6132, published 2017-12-21. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2, 11.6.0 to 11.6.1 and 11.5.0 - 11.5.4, an undisclosed sequence of…
CVE-2017-6133, published 2017-12-21. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, undisclosed HTTP requests may cause a denial of service.
CVE-2017-6166, published 2017-11-22. Medium severity, CVSS 5.9. EPSS: 1.9% chance of exploitation in the next 30 days. In BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe software 12.0.0 to 12.1.1, in some cases the Traffic Management Microkernel (TMM) may crash when processing…
CVE-2017-6150, published 2018-03-01. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. Under certain conditions for F5 BIG-IP systems 13.0.0 or 12.1.0 - 12.1.3.1, using FastL4 profiles, when the Reassemble IP Fragments option is disabled (default), some specific large fragmented…
CVE-2017-6151, published 2017-12-21. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator and WebSafe software version 13.0.0, undisclosed requests made to BIG-IP virtual servers…
CVE-2017-6135, published 2017-12-21. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a result of undisclosed IPv4 or IPv6 packets sent to BIG-IP…
CVE-2017-6140, published 2017-12-21. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. On the BIG-IP 2000s, 2200s, 4000s, 4200v, i5600, i5800, i7600, i7800, i10600,i10800, and VIPRION 4450 blades, running version 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0,…
CVE-2017-6138, published 2017-12-21. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, malicious requests made to virtual servers with an HTTP…
CVE-2017-6136, published 2017-12-21. Medium severity, CVSS 5.9. EPSS: 1.4% chance of exploitation in the next 30 days. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0 and 12.0.0 - 12.1.2, undisclosed traffic patterns sent to BIG-IP virtual servers,…

Latest

CVE-2018-5501, published 2018-03-01. Medium severity, CVSS 5.9. EPSS: 1.3% chance of exploitation in the next 30 days. In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffering due to lack of flow control.
CVE-2018-5500, published 2018-03-01. Medium severity, CVSS 5.9. EPSS: 1.3% chance of exploitation in the next 30 days. On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small amount of memory. Virtual server using TCP profile with…
CVE-2017-6167, published 2017-12-21. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software version 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl REST may lead to commands being…