What is the CVSS score of CVE-2016-3989?

CVE-2016-3989 has a CVSS 3.0 base score of 8.1 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 9.8%.

Is there a public PoC exploit available for CVE-2016-3989?

Yes, a public proof-of-concept exploit is available for CVE-2016-3989. Prioritise patching immediately. EPSS: 9.8%.

Ntp Server Firmware CVE-2016-3989

HIGH

Permissions, Privileges, and Access Controls (CWE-264)

2016-07-03 cve@mitre.org

Privilege Escalation Ntp Server Firmware Ims Lantime M1000 Ims Lantime M3000 Ims Lantime M500 Lantime M100 Lantime M200 Lantime M300 Lantime M400 Lantime M600 Lantime M900 Lces Syncfire 1100

8.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Jul 03, 2016 - 14:59 cve.org

HIGH 8.1

DescriptionCVE.org

The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account.

AnalysisAI

The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100,. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account. Affected products include: Meinberg Ntp Server Firmware, Meinberg Ims-Lantime M1000, Meinberg Ims-Lantime M3000, Meinberg Ims-Lantime M500, Meinberg Lantime M100. Version information: before 6.20.004.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.