CVE-2016-1547 describes a denial-of-service vulnerability affecting NTP 4.2.8p4 and earlier, as well as NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An unauthenticated, off-path attacker can disrupt a client's association with its NTP peer by sending a spoofed crypto NAK packet, even when authentication is enabled. This medium-severity vulnerability (CVSS 5.3) has a low impact of availability, requiring no user interaction. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.2.8CPE matchmatch criteria | cpe:2.3:a:ntp:ntp:*:p4:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.