CVE-2018-5527

Name: CVE-2018-5527
Creator: NVD / NIST
Published: 2018-06-27T20:29:05.963+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.58%

Last modified Jun 17, 2026

CVE-2018-5527 is a vulnerability of currently unknown severity. On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the SSL Forward Proxy feature enabled can force the Traffic Management Microkernel (tmm) to leak memory. As a result, system memory usage increases over time, which may eventually cause a decrease in performance or a system reboot due to memory exhaustion.. EPSS estimates a 2.58% chance of exploitation in the next 30 days.

Description

On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the SSL Forward Proxy feature enabled can force the Traffic Management Microkernel (tmm) to leak memory. As a result, system memory usage increases over time, which may eventually cause a decrease in performance or a system reboot due to memory exhaustion.

Metrics

EPSS Probability

2.58%

83.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-772

Affected Software

Vendor	Product	Versions
F5	Big-Ip Access Policy Manager	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Advanced Firewall Manager	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Analytics	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Application Acceleration Manager	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Application Security Manager	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Domain Name System	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Edge Gateway	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Global Traffic Manager	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Link Controller	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Local Traffic Manager	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Policy Enforcement Manager	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Webaccelerator	>= 13.0.0, <= 13.1.0.7
F5	Big-Ip Websafe	>= 13.0.0, <= 13.1.0.7

References

http://www.securitytracker.com/id/1041196Third Party Advisory, VDB Entry
https://support.f5.com/csp/article/K20134942Vendor Advisory
http://www.securitytracker.com/id/1041196Third Party Advisory, VDB Entry
https://support.f5.com/csp/article/K20134942Vendor Advisory

Timeline

Published: Jun 27, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-5527?

How severe is CVE-2018-5527?

Severity scoring for CVE-2018-5527 is pending analysis. The EPSS model estimates a 2.58% probability of exploitation in the next 30 days.

How do I fix CVE-2018-5527?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-5527?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST