How severe is CVE-2025-58066?

CVE-2025-58066 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2025-58066 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-58066?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-58066 have an EU (EUVD) identifier?

Yes. CVE-2025-58066 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-26241.

When was CVE-2025-58066 published?

CVE-2025-58066 was published on 2025-08-29 and last updated on 2026-06-17.

CVE-2025-58066

CVE-2025-58066 is a medium-severity vulnerability with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-406.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (23rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-26241
Weakness: CWE-406
Published: 2025-08-29
Last modified: 2026-06-17

Description

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. In versions between 1.2.0 and 1.6.1 inclusive servers which allow non-NTS traffic are affected by a denial of service vulnerability, where an attacker can induce a message storm between two NTP servers running ntpd-rs. Client-only configurations are not affected. Affected users are recommended to upgrade to version 1.6.2 as soon as possible.

Frequently asked questions

What is CVE-2025-58066?: nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. In versions between 1.2.0 and 1.6.1 inclusive servers which allow non-NTS traffic are affected by a denial of service vulnerability, where an attacker can induce a message storm between two NTP servers running ntpd-rs. Client-only configurations are not affected. Affected users are recommended to upgrade to version 1.6.2 as soon as possible.
How severe is CVE-2025-58066?: CVE-2025-58066 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2025-58066 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (23rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-58066?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-58066 have an EU (EUVD) identifier?: Yes. CVE-2025-58066 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-26241.
When was CVE-2025-58066 published?: CVE-2025-58066 was published on 2025-08-29 and last updated on 2026-06-17.

References

Other CWE-406 vulnerabilities

CVE-2021-38135 — High (CVSS 8.6): Possible External Service Interaction attack in iManager has been discovered in OpenText™ iManager 3.2.6.0000.
CVE-2022-0028 — High (CVSS 8.6): A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified…
CVE-2021-38487 — High (CVSS 8.2): RTI Connext Professional versions 4.1 to 6.1.0, and Connext Micro versions 2.4 and later are vulnerable when an…
CVE-2023-49203 — High (CVSS 7.5): Technitium 11.5.3 allows remote attackers to cause a denial of service (bandwidth amplification) because the DNSBomb…
CVE-2023-28456 — High (CVSS 7.5): An issue was discovered in Technitium through 11.0.2. It enables attackers to launch amplification attacks (3 times…
CVE-2023-28455 — High (CVSS 7.5): An issue was discovered in Technitium through 11.0.2. The forwarding mode enables attackers to create a query loop…

Browse all CWE-406 vulnerabilities →