CVE-2008-2476 json
The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10…
published 2008-10-03 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-2471
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.4%
- EPSS 7.4% chance of exploitation in 30 days, percentile 94%
- public exploits
- 0
- none known
Summary
The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).
Exploit prediction
7.42% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
openbsd.org
/errata42.html#015_ndp
vendor-advisory
-
security.freebsd.org
/advisories/FreeBSD-SA-08:10.nd6.asc
vendor-advisory
-
openbsd.org
/errata43.html#006_ndp
vendor-advisory
-
secunia.com
/advisories/32112
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/32117
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/32406
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/45601
vdb-entry
- support.apple.com /kb/HT3467
-
vupen.com
/english/advisories/2008/2751
vdb-entry
-
securitytracker.com
/id?1021109
vdb-entry
-
securitytracker.com
/id?1020968
vdb-entry
-
secunia.com
/advisories/32133
third-party-advisory
-
kb.cert.org
/vuls/id/472363
third-party-advisory, us-government-resource
-
kb.cert.org
/vuls/id/MAPG-7H2RY7
us-government-resource
-
secunia.com
/advisories/32116
third-party-advisory
-
securitytracker.com
/id?1021132
vdb-entry
- juniper.net /alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view
-
vupen.com
/english/advisories/2008/2750
vdb-entry
-
vupen.com
/english/advisories/2008/2752
vdb-entry
-
securityfocus.com
/bid/31529
vdb-entry
-
kb.cert.org
/vuls/id/MAPG-7H2S68
us-government-resource
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5670
vdb-entry, signature
-
vupen.com
/english/advisories/2009/0633
vdb-entry
Sources
- CVE List CVE-2008-2476
- NVD CVE-2008-2476
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.