CVE-2023-4012

HighCVSS 7.5

Published: 07/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

CVE-2023-4012 affects ntpd, which crashes when the server is not NTS-enabled (no certificate) and receives a request from an NTS-enabled client (mode 3).

Risk Assessment

Crashes of ntpd can lead to disruptions in time synchronization, potentially affecting the operation of applications and systems that rely on accurate time.

Recommendation

It is recommended to enable NTS on the server or properly configure clients to avoid sending NTS requests to servers that do not support this feature.

Other vulnerabilities in ntpd

CVE-2016-9312High
In ntpd versions before 4.2.8p9, when running on Windows, there is a vulnerability that allows remote attackers to cause a denial of service by sending a large UDP packet.

Original NVD description (English source)

ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3).