What’s Vulnerable › Vulnerabilities
CVE-2018-5542
- Severity: high (CVSS 8.1 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-07-25 · updated 2026-06-17
- Weakness: CWE-20
Description
F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.6, or 11.2.1-11.6.3.2 HTTPS health monitors do not validate the identity of the monitored server.
Affected products
- F5 BIG-IP APM: from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- BIG-IP: from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- F5 Big-Ip Analytics: from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- F5 Networks, Inc. BIG-IP (AAM): from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- BIG-IP ASM: from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- F5 BIG-IP DNS: from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- F5 Big-Ip Edge Gateway: from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- F5 Big-Ip Fraud Protection Service: from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- F5 Big-Ip Global Traffic Manager: from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- F5 Big-Ip Link Controller: from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- F5 BIG-IP (LTM): from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- F5 Networks, Inc. BIG-IP (PEM): from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
- F5 Big-Ip Webaccelerator: from 11.2.1 through 11.6.3; from 12.1.0 through 12.1.3; from 13.0.0 through 13.0.1
References
Get alerted when CVE-2018-5542 or the next vulnerability affects your stack