CVE-2015-7705 describes a critical vulnerability in NTP 4.x versions prior to 4.2.8p4 and 4.3.x prior to 4.3.77, affecting products from vendors like Citrix, NetApp, NTP, and Siemens. This flaw in the rate limiting feature allows remote attackers to cause significant impact through a high volume of crafted requests. With a CVSS score of 9.8 (Critical), it is easily exploitable over the network with low attack complexity, potentially leading to high confidentiality, integrity, and availability impacts. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered community discussion and media coverage, indicating awareness of its severity.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.2.0, < 4.2.8CPE matchmatch criteria | cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:* | ||
>= 4.3.0, < 4.3.77CPE matchmatch criteria | cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:* | ||
4.2.8CPE matchmatch criteria | cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:* | ||
4.2.8CPE matchmatch criteria | cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:* | ||
4.2.8CPE matchmatch criteria | cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.