CVE-2016-2517

CVE-2016-2517 is a denial-of-service vulnerability affecting NTP versions before 4.2.8p7 and 4.3.x before 4.3.92. An authenticated remote attacker, with knowledge of the controlkey or requestkey, can send a crafted packet to ntpd, altering critical authentication keys and preventing subsequent authentication. This vulnerability has a CVSS v3.0 score of 5.3 (Medium), indicating a network attack vector with high attack complexity, leading to high availability impact. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Despite its low EPSS score and FAUCET Risk Score, it has received some community discussion and media coverage.