Skip to content
Fencer Vulns
high 7.3

CVE-2016-3988 json

Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500,…

published 2016-07-03 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-4997

cvss
7.3
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

Multiple stack-based buffer overflows in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allow remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-16-175-03 updated cvss 7.3

Meinberg NTP Time Server Vulnerabilities

  • Meinberg IMS-LANTIME M500 <=6.0 Meinberg IMS-LANTIME M1000 <=6.0 Meinberg IMS-LANTIME M3000 <=6.0 Meinberg LANTIME M100 <=6.0 Meinberg LANTIME M200 <=6.0 Meinberg LANTIME M300 <=6.0
    +5 more products
    Meinberg LANTIME M400 <=6.0 Meinberg LANTIME M600 <=6.0 Meinberg LANTIME M900 <=6.0 Meinberg LCES <=6.0 Meinberg SyncFire 1100 <=6.0
    affected: mitigation urldefense.proofpoint.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.