CVE-2016-6301 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2016-6301

CVE-2016-6301

Published:December 09, 2016

Updated:May 17, 2026

The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged NTP packet, which triggers a communication loop.

Related Resources (15)

http://seclists.org/fulldisclosure/2020/Aug/20

http://seclists.org/fulldisclosure/2019/Jun/18

https://seclists.org/bugtraq/2019/Sep/7

http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html

https://access.redhat.com/security/cve/CVE-2016-6301

https://git.busybox.net/busybox/commit/?id=150dc7a2b483b8338a3e185c478b4b23ee884e71

http://seclists.org/fulldisclosure/2020/Mar/15

http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html

http://www.securityfocus.com/bid/92277

http://www.openwall.com/lists/oss-security/2016/08/03/7

https://bugzilla.redhat.com/show_bug.cgi?id=1363710

https://seclists.org/bugtraq/2019/Jun/14

http://seclists.org/fulldisclosure/2019/Sep/7

https://security-tracker.debian.org/tracker/CVE-2016-6301

https://security.gentoo.org/glsa/201701-05

Do you need more information?

CVSS v4

Base Score:

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

Vulnerable System Confidentiality

NONE

Vulnerable System Integrity

NONE

Vulnerable System Availability

HIGH

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Weakness Type (CWE)

Loop with Unreachable Exit Condition ('Infinite Loop')

CWE-835

EPSS

Base Score:

3.28