PT-2025-35316 · Ntpd-Rs+1 · Ntpd-Rs+1

Eric Sesterhenn · Published 2025-08-29 · Updated 2025-10-02 · CVE-2025-58066

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions ntpd-rs versions 1.2.0 through 1.6.1

Description ntpd-rs, a tool for synchronizing a computer's clock implementing the NTP and NTS protocols, contains a denial of service issue. When configured as a server, the software incorrectly responds to all NTP messages, including those from other servers. This can lead to a message storm between two ntpd-rs servers, consuming significant resources. Client-only configurations are not affected.

Recommendations Upgrade to version 1.6.2 as soon as possible. If upgrading is not possible, mitigate the issue by whitelisting access to only client IP addresses using the ignore filter method. Block incoming non-request traffic on the NTP server port using a firewall. Disable public access to the vulnerable NTP server. Disable the server functionality by removing any [server] sections from the configuration.

Exploit

Fix

DoS

Weakness Enumeration

CWE-406

Related Identifiers

CVE-2025-58066

GHSA-4855-Q42W-5VR4

Affected Products

Debian

Ntpd-Rs

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58066.json · Exploit
• https://security-tracker.debian.org/tracker/CVE-2025-58066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58066 · Security Note
• https://osv.dev/vulnerability/GHSA-4855-q42w-5vr4 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-58066 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-58066 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-58066 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58066 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-58066 · Security Note
• https://github.com/pendulum-project/ntpd-rs/security/advisories/GHSA-4855-q42w-5vr4 · Note
• https://github.com/pendulum-project/ntpd-rs/commit/da37cf167736cbd4d7804b1ed7ceb572468298e0 · Note
• https://github.com/pendulum-project/ntpd-rs · Note
• https://t.me/CVEtracker/31285 · Telegram Post
• https://twitter.com/CVEnew/status/1961537852866502991 · Twitter Post
• https://twitter.com/Cezar_H_Linux/status/1973858827574661358 · Twitter Post