CVE-2020-15025: Netapp 8300 Firmware

Medium severity, CVSS 4.9. EPSS: 3.4% chance of exploitation in the next 30 days.

ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.

Affected products

• Netapp 8300 Firmware: affected versions not specified
• Netapp 8700 Firmware: affected versions not specified
• Netapp a400 Firmware: affected versions not specified
• Netapp Cloud Backup: affected versions not specified
• Netapp h300e Firmware: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410c Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500e Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700e Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Steelstore Cloud Integrated Storage: affected versions not specified
• Ntp Ntp: from 4.3.97, before 4.3.101 (fixed in 4.3.101); version 4.2.8 only
• Opensuse Leap: version 15.1 only; version 15.2 only
• Oracle ZFS Storage Appliance Kit: version 8.8 only

Published 2020-06-24. Last modified 2026-06-17.