Skip to content
Fencer Intel
high 8.1

CVE-2016-3989 json

The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400,…

published 2016-07-03 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-4998

cvss
8.1
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.1%
EPSS 5.1% chance of exploitation in 30 days, percentile 92%
public exploits
1
Exploit-DB

Summary

The NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote authenticated users to obtain root privileges for writing to unspecified scripts, and consequently obtain sensitive information or modify data, by leveraging access to the nobody account.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-16-175-03 updated cvss 8.1

Meinberg NTP Time Server Vulnerabilities

  • Meinberg IMS-LANTIME M500 <=6.0 Meinberg IMS-LANTIME M1000 <=6.0 Meinberg IMS-LANTIME M3000 <=6.0 Meinberg LANTIME M100 <=6.0 Meinberg LANTIME M200 <=6.0 Meinberg LANTIME M300 <=6.0
    +5 more products
    Meinberg LANTIME M400 <=6.0 Meinberg LANTIME M600 <=6.0 Meinberg LANTIME M900 <=6.0 Meinberg LCES <=6.0 Meinberg SyncFire 1100 <=6.0
    affected: mitigation urldefense.proofpoint.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

  1. Published
  2. First public exploit (EDB-40120)

Exploit prediction

5.09% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-40120 Meinberg NTP Time Server ELX800/GPS M4x V5.30p - Remote Command Execution / Escalate Privileges remote, 2016-07-17

CVSS scores

assigned by version score vector
NVD 3.0 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 8.5 AV:N/AC:L/Au:S/C:C/I:C/A:N

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.