CVE-2018-7170
Synology
- Published
- 6 March 2018
- Last modified
- 17 June 2026
- CVSS
- 5.3 v3.1
- Severity
- medium
- EPSS
- 2.7% (85th pct)
- CISA KEV
- Not listed
- NVD status
- Modified
- Weaknesses
- None assigned
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Description
ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.
Exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. That is an absence of confirmed public exploitation, not evidence that exploitation has not occurred. EPSS models a 2.7% probability of exploitation activity in the next 30 days.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| VS960HD | Synology | unknown | < 2.2.3-1505, < 2.3.6-1720 |
References
- http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html third-party
- http://support.ntp.org/bin/view/Main/NtpBug3415 third-party
- http://www.securityfocus.com/archive/1/541824/100/0/threaded third-party
- http://www.securityfocus.com/bid/103194 third-party
- https://bugzilla.redhat.com/show_bug.cgi?id=1550214 third-party
- https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc third-party
- https://security.gentoo.org/glsa/201805-12 third-party
- https://security.netapp.com/advisory/ntap-20180626-0001/ third-party
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us third-party
- https://www.synology.com/support/security/Synology_SA_18_13 third-party
- http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html third-party
- http://support.ntp.org/bin/view/Main/NtpBug3415 third-party
- http://www.securityfocus.com/archive/1/541824/100/0/threaded third-party
- http://www.securityfocus.com/bid/103194 third-party
- https://bugzilla.redhat.com/show_bug.cgi?id=1550214 third-party
- https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc third-party
- https://security.gentoo.org/glsa/201805-12 third-party
- https://security.netapp.com/advisory/ntap-20180626-0001/ third-party
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us third-party
- https://www.synology.com/support/security/Synology_SA_18_13 third-party
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.