PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-7973 Freebsd CVE debrief

CVE-2015-7973 is a medium-severity NTP issue that matters when ntpd is configured in broadcast mode. A network-positioned attacker who can sniff traffic may replay packets and influence synchronization behavior. NVD published the record on 2017-01-30 and later modified it on 2026-05-13.

Vendor
Freebsd
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2021-04-13
Original CVE updated
2025-06-10
Advisory published
2021-04-13
Advisory updated
2025-06-10

Who should care

Administrators running NTP/ntpd in broadcast mode, especially teams maintaining FreeBSD, Ubuntu, NetApp, Siemens, or other products listed in the NVD CPE scope.

Technical summary

NVD describes CVE-2015-7973 as affecting NTP before 4.2.8p6 and 4.3.x before 4.3.90 when broadcast mode is enabled. The attack requires a man-in-the-middle able to sniff the network and conduct replay attacks. NVD assigns CVSS 3.1 6.5/Medium (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H), reflecting that the issue is remotely reachable but requires favorable network positioning and mainly impacts integrity and availability.

Defensive priority

Medium priority: confirm whether broadcast mode is used, then schedule patching or mitigation for any exposed ntpd deployments.

Recommended defensive actions

  • Inventory systems running NTP/ntpd and identify any broadcast-mode configurations.
  • Upgrade affected NTP deployments to a fixed release at or above 4.2.8p6 or 4.3.90, as applicable.
  • Review vendor advisories for packaged products mapped in the NVD CPE list, including FreeBSD, Ubuntu, NetApp, and Siemens references.
  • If broadcast mode is not required, disable it to reduce exposure.
  • Monitor time-synchronization behavior for unexpected replay-like anomalies until remediation is complete.

Evidence notes

Source corpus states that NTP before 4.2.8p6 and 4.3.x before 4.3.90 is vulnerable in broadcast mode to replay attacks by a sniffing MITM. The NVD record links upstream/vendor advisories including support.ntp.org/NtpBug2935, FreeBSD-SA-16:09.ntp.asc, and multiple third-party advisories. The CPE list includes NTP, FreeBSD, Ubuntu, NetApp, and Siemens products, showing that exposure can extend beyond upstream NTP packaging. Several legacy reference URLs in the corpus are marked as broken links.

Sources and references

Verified primary and authoritative sources

  • CVE-2015-7973 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2015-7973

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2015-7973 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2015-7973

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.