CVE-2019-6444: NTPsec ntpd control packet stack buffer over-read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCritical CVSS severity with public exploit references and high EPSS, though not confirmed in KEV and limited to a read-based flaw.

What it is

NTPsec before 1.1.3 has a stack-based buffer over-read in process_control() in ntp_control.c, where attacker-controlled data is dereferenced by ntohl() in ntpd. The flaw is remotely reachable and can crash or expose memory contents, making it a serious availability and information-disclosure risk for exposed NTP servers.

Impact

An unauthenticated remote attacker can trigger an out-of-bounds read, causing a denial of service and potentially leaking process memory contents.

Attack surface

Reached over the network via crafted NTP control packets to ntpd; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.457 (98.7th percentile) and multiple references are tagged Exploit, including an Exploit-DB entry, indicating public exploit material exists.

What to do

• Upgrade NTPsec to 1.1.3 or later, which contains the fix.
• If immediate patching is not possible, restrict NTP control queries (mode 6) to trusted management hosts via firewall or ACL rules.
• Disable or block remote ntpd control/monitoring access on internet-facing systems.
• Monitor vendor advisories and release notes for any follow-up fixes.

Detection

• Alert on ntpd crashes, restarts or core dumps on NTP servers.
• Inspect network traffic for unusual mode 6 NTP control packets from untrusted sources.
• Review firewall logs for inbound NTP control traffic reaching exposed servers.
• Correlate host logs for ntpd memory errors or abnormal termination events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.