HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2015-7974

CVSS 7.7v3.1pub. 2016-01-26upd. 2026-05-06

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

  • Debian

    OS
    Debian
    8.09.0

  • Netapp Clustered Data Ontap

    APP
    Netapp
    all versions

  • Netapp Oncommand Balance

    APP
    Netapp
    all versions

  • Ntp

    APP
    Ntp
    4.2.84.2.0 – 4.2.8 (excl.)4.3.0 – 4.3.90 (excl.)

  • Siemens Tim 4r Ie

    HW
    Siemens
    all versions

  • Siemens Tim 4r Ie Dnp3

    HW
    Siemens
    all versions

  • Siemens Tim 4r Ie Dnp3 Firmware

    OS
    Siemens
    all versions

  • Siemens Tim 4r Ie Firmware

    OS
    Siemens
    all versions
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2026-24061CRITICAL9.8⚠ KEVPL ✓same product

GNU Inetutils telnetd: ominięcie uwierzytelnienia przez zmienną USER

CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓same product

Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)

CVE-2025-49113CRITICAL9.9⚠ KEVPL ✓same product

RCE przez deserializację PHP w Roundcube Webmail (parametr _from)

CVE-2025-32433CRITICAL10.0⚠ KEVPL ✓same product

Erlang/OTP SSH — nieuwierzytelniony RCE (CVSS 10.0)

CVE-2025-24201CRITICAL10.0⚠ KEVPL ✓same product

Apple WebKit: out-of-bounds write umożliwiający ucieczkę z sandbox przeglądarki