CVE-2023-4012 HIGH

CVE-2023-4012: Incomplete Internal State Distinction in ntpsec

Vendor Ntpsec
Product ntpsec
Weakness CWE-372
Published August 7, 2023
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3).

Key dates

02Disclosure timeline

August 7, 2023 CVE published
May 12, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-36834 Junos OS: SRX 4600 and SRX 5000 Series: The receipt of specific genuine packets by SRXes configured for L2 transparency will cause a DoS CVE-2026-41300 OpenClaw < 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboarding CVE-2023-31127 DMTF-2023-0001: SPDM mutual authentication bypass CVE-2021-25735 Validating Admission Webhook does not observe some previous fields CVE-2026-41388 OpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling