CVE-2019-6443: NTPsec ntpd stack buffer over-read via ctl_getitem in read_sysvars

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCritical CVSS (9.1), high EPSS and public exploit code make this a strong candidate for exploitation, though it is not in CISA KEV and the flaw is an over-read rather than direct code execution.

What it is

NTPsec before 1.1.3 contains a bug in ctl_getitem that causes a stack-based buffer over-read in read_sysvars in ntp_control.c within ntpd. The flaw is remotely reachable over the network without authentication, and the over-read can disclose memory contents or crash the daemon. It matters because NTP daemons are widely exposed and often run with elevated privileges.

Impact

An unauthenticated remote attacker can read out-of-bounds stack memory, potentially leaking sensitive data, and can trigger a denial of service by crashing ntpd. The CVSS vector rates confidentiality and availability impact as high.

Attack surface

Reached over the network via the NTP control protocol handled by ntpd; the CVSS vector shows AV:N, PR:N, UI:N, so no authentication or user interaction is required. Any host exposing the affected ntpd control interface is in scope.

Exploitation

Public exploit code is referenced (Exploit and ExploitDB tags), and EPSS is 0.66881 at the 99.258th percentile, indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Upgrade NTPsec to 1.1.3 or later, which contains the fix noted in the release notes.
• If immediate patching is not possible, restrict access to the ntpd control interface (UDP/TCP 123 and any configured control port) to trusted management networks only.
• Disable or block remote mode 6 control queries where they are not operationally required.
• Run ntpd with least privilege and monitor for unexpected daemon restarts or crashes.
• Track vendor advisories for NTPsec and downstream distributions for backported fixes.

Detection

• Monitor ntpd logs and system logs for crashes, restarts or abnormal termination of the daemon.
• Alert on unexpected or high-volume mode 6 control queries to ntpd from untrusted sources.
• Use network monitoring to flag NTP control traffic originating outside expected management hosts.
• Check host integrity or memory-disclosure indicators for signs of leaked process memory in responses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.