CVE-2018-7184
Synology
- Published
- 6 March 2018
- Last modified
- 17 June 2026
- CVSS
- 7.5 v3.0
- Severity
- high
- EPSS
- 8.5% (95th pct)
- CISA KEV
- Not listed
- NVD status
- Modified
- Weaknesses
- None assigned
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.
Exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. That is an absence of confirmed public exploitation, not evidence that exploitation has not occurred. EPSS models a 8.5% probability of exploitation activity in the next 30 days, placing it in the top decile of all scored CVEs.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| VS960HD | Synology | unknown | < 2.2.3-1505, < 2.3.6-1720 |
References
- http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html third-party
- http://support.ntp.org/bin/view/Main/NtpBug3453 third-party
- http://www.securityfocus.com/archive/1/541824/100/0/threaded third-party
- http://www.securityfocus.com/bid/103192 third-party
- https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc third-party
- https://security.gentoo.org/glsa/201805-12 third-party
- https://security.netapp.com/advisory/ntap-20180626-0001/ third-party
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
- https://usn.ubuntu.com/3707-1/ third-party
- https://www.synology.com/support/security/Synology_SA_18_13 third-party
- http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html third-party
- http://support.ntp.org/bin/view/Main/NtpBug3453 third-party
- http://www.securityfocus.com/archive/1/541824/100/0/threaded third-party
- http://www.securityfocus.com/bid/103192 third-party
- https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc third-party
- https://security.gentoo.org/glsa/201805-12 third-party
- https://security.netapp.com/advisory/ntap-20180626-0001/ third-party
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us
- https://usn.ubuntu.com/3707-1/ third-party
- https://www.synology.com/support/security/Synology_SA_18_13 third-party
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.