CVE-2016-1547: Ntp

Medium severity, CVSS 5.3. EPSS: 5.1% chance of exploitation in the next 30 days.

An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.

Affected products

• Ntp Ntp: up to and including 4.2.8

Published 2017-01-06. Last modified 2026-06-17.