CVE-2026-102483
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.
Risk Assessment
An attacker can remotely stop the NTP service, causing denial of service for clients relying on time synchronization. This can disrupt systems requiring accurate time.
Recommendation
Update NTPsec to a version later than 1.2.5 if available. Consider restricting access to the NTP service from untrusted networks.
Other vulnerabilities in NTPsec ntpd
See all- CVE-2026-102486High
Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash the daemon via an NTS Authenticator and Encrypted Extension Fields (AEEF) field with an oversized nonce length.
- CVE-2026-102485Medium
Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.
Original NVD description (English source)
Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS