CVE-2020-13817: fujitsu m10-1_firmware Use of Insufficiently Random Values
Vulnerability summary
CVE-2020-13817 is a high (CVSS 7.4) Use of Insufficiently Random Values vulnerability in fujitsu m10-1_firmware. EPSS estimates a 3.25% chance of exploitation in the next 30 days, higher than 88.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Duplicates 1 · Related 6Timeline
- 04-06-2020PublishedVulnerability first disclosed.
- 05-05-2025Last modifiedVulnerability information updated.
Description
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.
CVSS metrics
8 scores · 4 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- NVDNIST7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.9MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.25%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
-0.12 pp
From 3.38% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fujitsu6 products
- m10-1_firmware< xcp2410
- m10-4_firmware< xcp2410 | < xcp3110
- m10-4s_firmware< xcp2410 | < xcp3110
- m12-1_firmware< xcp2410 | < xcp3110
- m12-2_firmware< xcp2410 | < xcp3110
Debian1 product
- ntp< 1:4.2.8p14+dfsg-1
Ntp1 product
- ntp< 4.2.8 | ≥ 4.3.0, < 4.3.100 | 4.2.8 | 4.2.8:p1 | 4.2.8:p1-beta1 | 4.2.8:p1-beta2 | 4.2.8:p1-beta3 | 4.2.8:p1-beta4 | 4.2.8:p1-beta5 | 4.2.8:p1-rc1 | 4.2.8:p1-rc2 | 4.2.8:p10 | 4.2.8:p11 | 4.2.8:p12 | 4.2.8:p13 | 4.2.8:p2 | 4.2.8:p2-rc1 | 4.2.8:p2-rc2 | 4.2.8:p2-rc3 | 4.2.8:p3 | 4.2.8:p3-rc1 | 4.2.8:p3-rc2 | 4.2.8:p3-rc3 | 4.2.8:p4 | 4.2.8:p5 | 4.2.8:p6 | 4.2.8:p7 | 4.2.8:p8 | 4.2.8:p9
Opensuse1 product
- leapEOL15.1 | 15.2
Ubuntu1 product
- ntpAll versions (No fix recorded)
6 vendors · 27 products
References
10 links- lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
