Cyber Resilience

CVE-2023-4012

Ntpsec 1.2.2

Published
07 August 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0045 37th percentile
Risk Priority 57 floored blend · peak EPSS

Summary

CVE-2023-4012 is a high-severity Incomplete Internal State Distinction (CWE-372) vulnerability in Ntpsec Ntpsec. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3).

CWE(s)
CWE-372NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
T1556 Modify Authentication Process Defense Impairment
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2019-6443Same product: Ntpsec Ntpsec
CVE-2023-36834Shared CWE-372
CVE-2026-41340Shared CWE-372
CVE-2024-22590Shared CWE-372
CVE-2026-41388Shared CWE-372
CVE-2026-41300Shared CWE-372
CVE-2023-31127Shared CWE-372

Affected Assets

ntpsec
ntpsec
1.2.2

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC activities directly address proper state-machine design and testing that prevent incomplete state distinction.

ID.RA-01 partial match
prevents

Identifying recorded vulnerabilities can surface this class of state-management flaw during assessments.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect state-machine flaws that manifest as incomplete internal state distinction.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle practices can include state-machine validation and invariant checks that reduce incomplete internal state errors.

A.8.26 Application security requirements partial match
prevents

Explicit application security requirements can mandate state-transition validation and error-state handling.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles encourage explicit state modelling and fail-safe transitions.

A.8.28 Secure coding partial match
prevents

Secure coding standards can require defensive checks against invalid or ambiguous internal states.

A.8.32 Change management partial match
prevents

Change-management procedures may indirectly catch state-related defects during release reviews.

References