CVE-2016-3962 describes a stack-based buffer overflow in the NTP time-server interface of various Meinberg LANTIME and SyncFire devices running firmware prior to version 6.20.004. This vulnerability carries a high CVSS score of 7.3, indicating that a remote, unauthenticated attacker can exploit it with low complexity to potentially obtain sensitive information, modify data, or cause a denial of service. While not listed in CISA's KEV catalog, an exploit for remote command execution and privilege escalation exists on ExploitDB, and the vulnerability has garnered significant community discussion and media coverage, suggesting awareness and potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 6.0CPE matchmatch criteria | cpe:2.3:o:meinberg:ntp_server_firmware:*:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:h:meinberg:ims-lantime_m1000:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:h:meinberg:ims-lantime_m3000:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:h:meinberg:ims-lantime_m500:-:*:*:*:*:*:*:* | ||
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:h:meinberg:lantime_m100:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.