CVE-2022-48198

CRITICAL

ntpd_driver < 1.3.0 and 2.x < 2.2.0 - Unauthenticated Exposure of Resource to Wrong Sphere via time_ref_topic Parameter

Title source: llm
STIX 2.1

Description

The ntpd_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled time_ref_topic parameter.

References (3)

Core 3
Core References
Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/vooon/ntpd_driver/issues/9

Scores

CVSS v3 9.8
EPSS 0.0109
EPSS Percentile 60.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-668
Status published
Products (1)
ntpd_driver_project/ntpd_driver < 1.3.0
Published Jan 01, 2023
Tracked Since Feb 18, 2026