CVE-2026-102485 NTPsec CVE debrief

Who should care

System administrators and security teams responsible for NTPsec ntpd installations, particularly those using the Motorola Oncore refclock driver, should assess their exposure and take necessary remediation steps.

Why it matters

This vulnerability requires attention from system administrators and security teams using NTPsec ntpd, especially with the Motorola Oncore refclock driver. The vulnerability's impact is medium, with a CVSS score of 5.2, and its exploitation requires control over the GPS receiver's serial data. Remediation involves updating to version 1.2.6 or later and restricting access to the GPS receiver's serial data.

• Potential ntpd crashes or instability
• Possible memory disclosure via PPS Control replies
• Requires verification of affected versions and exposure
• Remediation priority for NTPsec ntpd installations

Technical summary

The Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 is vulnerable to an out-of-bounds read. An attacker who controls the GPS receiver's serial data can send a PPS Control (@@Gc) reply with an out-of-range mode byte, potentially crashing ntpd or disclosing memory. This vulnerability requires control over the GPS receiver's serial data and has a CVSS score of 5.2, indicating medium severity. Remediation involves updating to version 1.2.6 or later and restricting access to the GPS receiver's serial data. Affected systems should be reviewed for exposure and remediated accordingly.

Defensive priority

Medium priority, as the vulnerability requires an attacker to have control over the GPS receiver's serial data and has a CVSS score of 5.2.

Recommended defensive actions

• Review and update NTPsec ntpd to version 1.2.6 or later
• Restrict access to the GPS receiver's serial data
• Monitor ntpd logs for potential crashes or memory disclosure
• Perform an inventory of systems using the Motorola Oncore refclock driver
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE Program record and the NVD vulnerability detail page. The affected version is NTPsec ntpd before 1.2.6. Evidence is limited to public CVE details and NVD assessments. Defenders should verify affected versions, exposure, and apply remediation steps. Additional sources may provide further insights but are not cited here.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.