Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2015-8140

18
FAUCET Score

CVE-2015-8140 describes a replay attack vulnerability in the ntpq protocol of NTP versions prior to 4.2.8p7, affecting NTP software. This medium-severity vulnerability (CVSS 4.8) can be exploited remotely with high attack complexity, potentially leading to limited integrity and availability impacts by sniffing network traffic. Despite its FAUCET Risk Score of 84/100, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 4.2.8CPE matchmatch criteria
cpe:2.3:a:ntp:ntp:*:p6:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

4.8MEDIUM

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
LOW
Exploitability Score
2.2
Impact Score
2.5
CvssVersion
3.0

Exploit Intelligence

EPSS Score
4.64%
Probability of exploitation in next 30 days
EPSS Percentile
90.8%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0464 is in the 88th percentile among its peer group of 19,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (3)

redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: ntp
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: ntp
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: ntp

Vendor Advisories (1)

redhatCVE-2015-8140Moderate

ntp: ntpq protocol vulnerable to replay attacks

Jan 20, 2016

References

lists.opensuse.org / opensuse-security-announce/2016-04/msg00059.html
Third Party Advisory
lists.opensuse.org / opensuse-security-announce/2016-04/msg00060.html
Third Party Advisory
lists.opensuse.org / opensuse-security-announce/2016-05/msg00020.html
Third Party Advisory
lists.opensuse.org / opensuse-security-announce/2016-05/msg00038.html
Third Party Advisory
lists.opensuse.org / opensuse-security-announce/2016-05/msg00048.html
Third Party Advisory
lists.opensuse.org / opensuse-updates/2016-05/msg00114.html
Third Party Advisory
bto.bluecoat.com / security-advisory/sa113
Third Party Advisory
security.freebsd.org / advisories/FreeBSD-SA-16:09.ntp.asc
security.gentoo.org / glsa/201607-15
Third Party Advisory
security.netapp.com / advisory/ntap-20200204-0003
support.ntp.org / bin/view/Main/NtpBug2947
Vendor Advisory
kb.cert.org / vuls/id/718152
Third Party AdvisoryUS Government Resource
tools.cisco.com / security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd
Third Party Advisory
securitytracker.com / id/1034782
Third Party AdvisoryVDB Entry