PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7428 Ntp CVE debrief

CVE-2016-7428 is a denial-of-service issue in ntpd affecting NTP versions before 4.2.8p9. The flaw can cause broadcast mode packets to be rejected when the poll interval field is involved, so systems that rely on NTP broadcast synchronization should prioritize the fixed release.

Vendor
Ntp
Product
Unknown
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-13
Original CVE updated
2026-05-13
Advisory published
2017-01-13
Advisory updated
2026-05-13

Who should care

Administrators and operators running ntpd in NTP 4.2.8p6, 4.2.8p7, or 4.2.8p8, especially in environments that use broadcast mode time distribution. Embedded devices, appliances, and managed services that bundle ntpd should also be checked for fixed builds.

Technical summary

NVD describes the weakness as a remote denial of service in ntpd, with CVSS 3.0 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The affected CPE entries listed by NVD include ntp:ntp 4.2.8 p6, p7, and p8. NVD maps the issue to CWE-400 and links vendor materials for the 4.2.8p9 release and the associated bug/mitigation tracking.

Defensive priority

Medium priority: patch promptly if broadcast mode is in use, but the impact is limited to availability and the CVSS score is moderate.

Recommended defensive actions

  • Upgrade NTP/ntpd to 4.2.8p9 or a later fixed release.
  • Inventory hosts and appliances that ship ntpd, including embedded and vendor-managed systems, and verify their exact NTP build level.
  • Review whether broadcast mode is actually required in your environment; if it is, validate synchronization behavior after upgrading.
  • Use the linked vendor release notes and bug/mitigation references to confirm the corrected version and any deployment guidance.

Evidence notes

The source corpus states that ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service by manipulating the poll interval in a broadcast packet. NVD lists vulnerable versions 4.2.8p6, 4.2.8p7, and 4.2.8p8, assigns CVSS 3.0 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and classifies the weakness as CWE-400. Vendor-linked references include release notes for 4.2.8p9 and an NtpBug3113 mitigation/issue-tracking page. CVE record publication is dated 2017-01-13; the later 2026-05-13 modified timestamp reflects record maintenance, not the vulnerability's original disclosure date.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7428 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7428

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7428 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7428

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.