CVE-2018-5738

CVE-2018-5738 is a vulnerability in ISC BIND versions 9.9.12, 9.10.7, 9.11.3, 9.12.0-9.12.1-P2, and 9.13.0, as well as Supported Preview Editions. It allows unauthorized recursive queries to a nameserver due to an incorrect default setting for "allow-recursion" when "recursion yes;" is enabled and no explicit match lists are provided for "allow-query-cache" or "allow-query". This flaw can lead to information disclosure as it improperly permits recursion to all clients. The vulnerability has a CVSSv3 score of 7.5 (High), indicating a network-based attack with low complexity, requiring no privileges or user interaction, and potentially leading to high confidentiality impact. Its EPSS score is low at 0.03303, suggesting a low probability of exploitation in the wild. There is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with the majority of reported vulnerabilities.