{"schemaVersion":3,"id":"CVE-2008-2476","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB).","dates":{"published":"2008-10-03T15:00:00.000Z","modified":"2024-08-07T09:05:29.861Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.07425,"percentile":0.94393,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.07425},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.07425,"percentile":0.94393}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.07425,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.07425,"percentile":0.94393}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"}],"affected":[{"vendor":"freebsd","product":"freebsd","name":"freebsd","label":"freebsd","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"6.3","noFixRecorded":false,"fixedIn":null},{"text":"7.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"6.3 | 7.1","eol":{"isEol":true,"eolDate":"2010-01-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"6.3","label":"releng/6.3","eolFrom":"2010-01-31T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"freebsd","label":"FreeBSD","category":"os"}},"hubHref":"/vendor/freebsd/freebsd"},{"vendor":"openbsd","product":"openbsd","name":"openbsd","label":"openbsd","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"4.2","noFixRecorded":false,"fixedIn":null},{"text":"4.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.2 | 4.3","eol":{"isEol":true,"eolDate":"2008-11-01T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"4.2","label":"4.2","eolFrom":"2008-11-01T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"openbsd","label":"OpenBSD","category":"os"}},"hubHref":"/vendor/openbsd/openbsd"},{"vendor":"windriver","product":"vxworks","name":"vxworks","label":"vxworks","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.4","noFixRecorded":false,"fixedIn":null},{"text":"5","noFixRecorded":false,"fixedIn":null},{"text":"5.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.4 | 5 | 5.5","eol":null,"hubHref":"/vendor/windriver/vxworks"}],"affectedCount":3,"eol":{"hasEol":true,"count":2},"references":[{"url":"http://secunia.com/advisories/32406","label":"secunia.com/advisories/32406","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/45601","label":"exchange.xforce.ibmcloud.com/vulnerabilities/45601","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://support.apple.com/kb/HT3467","label":"support.apple.com/kb/HT3467","hostname":"support.apple.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.openbsd.org/errata42.html#015_ndp","label":"www.openbsd.org/errata42.html","hostname":"www.openbsd.org","tags":["Vendor Advisory","X Refsource OPENBSD"]},{"url":"http://www.vupen.com/english/advisories/2008/2751","label":"www.vupen.com/english/advisories/2008/2751","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.securitytracker.com/id?1021109","label":"www.securitytracker.com/id?1021109","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://securitytracker.com/id?1020968","label":"securitytracker.com/id?1020968","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://secunia.com/advisories/32133","label":"secunia.com/advisories/32133","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.kb.cert.org/vuls/id/472363","label":"www.kb.cert.org/vuls/id/472363","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://www.kb.cert.org/vuls/id/MAPG-7H2RY7","label":"www.kb.cert.org/vuls/id/MAPG-7H2RY7","hostname":"www.kb.cert.org","tags":["X Refsource CONFIRM","US Government Resource"]},{"url":"http://secunia.com/advisories/32116","label":"secunia.com/advisories/32116","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securitytracker.com/id?1021132","label":"www.securitytracker.com/id?1021132","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"https://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view","label":"www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2008-09-036&viewMode=view","hostname":"www.juniper.net","tags":["X Refsource MISC"]},{"url":"http://www.vupen.com/english/advisories/2008/2750","label":"www.vupen.com/english/advisories/2008/2750","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2008/2752","label":"www.vupen.com/english/advisories/2008/2752","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.securityfocus.com/bid/31529","label":"www.securityfocus.com/bid/31529","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://www.kb.cert.org/vuls/id/MAPG-7H2S68","label":"www.kb.cert.org/vuls/id/MAPG-7H2S68","hostname":"www.kb.cert.org","tags":["X Refsource CONFIRM","US Government Resource"]},{"url":"http://security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.asc","label":"security.freebsd.org/advisories/FreeBSD-SA-08:10.nd6.asc","hostname":"security.freebsd.org","tags":["Vendor Advisory","X Refsource FREEBSD"]},{"url":"http://www.openbsd.org/errata43.html#006_ndp","label":"www.openbsd.org/errata43.html","hostname":"www.openbsd.org","tags":["Vendor Advisory","X Refsource OPENBSD"]},{"url":"http://secunia.com/advisories/32112","label":"secunia.com/advisories/32112","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5670","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5670","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://secunia.com/advisories/32117","label":"secunia.com/advisories/32117","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/0633","label":"www.vupen.com/english/advisories/2009/0633","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2008-10-03T15:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T09:05:29.861Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T10:38:53.872Z","stale":false,"partial":false}}