CVE-2015-5477 · Critical · CISA KEV

ISC BIND TKEY Vulnerability: Critical DoS Risk, Exploited in the Wild

Threat Engine Auto-Feed · data current as of 2026-10-08

A data processing error in ISC BIND, CVE-2015-5477, allows remote attackers to trigger a denial of service (DoS) via crafted TKEY queries. This vulnerability is listed in CISA KEV, indicating active exploitation, and has an EPSS score in the 99th percentile, signaling high exploitability. Organizations using affected BIND versions face a significant operational risk.

  • CVSS:
  • EPSS percentile: 0.9981
  • Exploitation pressure: 85/100 (Critical)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 100th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves a data processing error within the ISC BIND software. When the software handles specific types of TKEY queries, it processes the data incorrectly, leading to a system crash or unresponsiveness, effectively causing a denial of service.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations relying on ISC BIND for DNS resolution
  • Financial services organizations (targeted by FIN7, LockBit affiliates, APT38)
  • Technology sector organizations (targeted by APT29, Scattered Spider)

Misconfigurations that escalate it

  • Running unpatched or end-of-life versions of ISC BIND
  • Insufficient monitoring of DNS server health and query anomalies

High-impact scenarios

  • Complete disruption of DNS resolution services, leading to widespread network outages and inaccessible applications.
  • Operational paralysis for critical business functions dependent on DNS.
  • Reputational damage and financial losses due to service unavailability.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor BIND server logs for unusual TKEY query patterns or high volumes from unexpected sources.
  • Implement network intrusion detection systems (NIDS) to identify anomalous DNS traffic targeting BIND.
  • Monitor BIND process health and resource utilization for sudden spikes or crashes.

Contain

  • Isolate affected BIND servers if compromise is suspected to prevent further impact.
  • Implement rate limiting for TKEY queries to mitigate DoS attempts.
  • Temporarily block TKEY queries from untrusted or external sources if not strictly required.

Patch

  • Apply the latest security patches and updates for ISC BIND to address CVE-2015-5477.
  • Upgrade to supported versions of BIND if currently running an end-of-life release.

Frontier verdict — Critical

This is a critical denial-of-service vulnerability in ISC BIND, actively exploited in the wild and with a high EPSS score, demanding immediate patching and robust detection strategies.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.