Every CVESearch/Get API key

CVE-2016-3698

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor...

8.1 HighFix available

CVE-2016-3698 is a high vulnerability (CVSS 8.1) in Libndp, published May 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.81%, the 90th percentile. Fixed in libndp 1.6-1.

What does this mean?
Severity
8.1 HighCVSS 3.0, NVD
Exploit chance
3.81%EPSS, 90th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
1.6-1libndp +18 more

Description

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.81%Up 2.5 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libndp
Debian:12
before 1.6-1
1.6-1
libndp
Debian:13
before 1.6-1
1.6-1
libndp
Debian:14
before 1.6-1
1.6-1
libndp
Debian:8
before 1.4-2+deb8u1, plus listed versions
1.4-2
1.4-2+deb8u1
libndp
Mageia:5
before 1.4-3.1.mga5
1.4-3.1.mga5
libndp
Red Hat:enterprise_linux:7::client
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp-debuginfo
Red Hat:enterprise_linux:7::client
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp-devel
Red Hat:enterprise_linux:7::client
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp
Red Hat:enterprise_linux:7::computenode
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp-debuginfo
Red Hat:enterprise_linux:7::computenode
before 0:1.2-6.el7_2
0:1.2-6.el7_2
Show 9 moreShow less
Affected packages
PackageAffectedFixed
libndp-devel
Red Hat:enterprise_linux:7::computenode
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp
Red Hat:enterprise_linux:7::server
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp-debuginfo
Red Hat:enterprise_linux:7::server
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp-devel
Red Hat:enterprise_linux:7::server
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp
Red Hat:enterprise_linux:7::workstation
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp-debuginfo
Red Hat:enterprise_linux:7::workstation
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp-devel
Red Hat:enterprise_linux:7::workstation
before 0:1.2-6.el7_2
0:1.2-6.el7_2
libndp
Ubuntu:16.04:LTS
before 1.4-2ubuntu0.16.04.1, plus listed versions
1.4-2
1.4-2ubuntu0.16.04.1
libndp
openSUSE:Tumbleweed
before 1.6-2.3
1.6-2.3

What each source reports

NVD Score used8.1

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

Record
CVE-2016-3698
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-284
Updated
2026-11-02
CVE ListNo score

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

Record
CVE-2016-3698
Updated
2026-11-02
EUVDEUVD-2016-4719No score

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

Record
EUVD-2016-4719
Updated
2026-11-03
GitHub AdvisoriesGHSA-rj7j-9h37-7pw78.1

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor...

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

Record
GHSA-rj7j-9h37-7pw7
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
OSV8.1

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

Record
CVE-2016-3698
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-36988.1

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

Record
DEBIAN-CVE-2016-3698
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2016-36988.1

libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct man-in-the-middle attacks or cause a denial of service (network connectivity disruption) by advertising a node as a router from a non-local network.

Record
UBUNTU-CVE-2016-3698
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0185No score

Updated libndp packages fix CVE-2016-3698

Updated libndp package fixes security vulnerability:

Libndp is a library (used by NetworkManager) that provides a wrapper for the IPv6 Neighbor Discovery Protocol. It also provides a tool named ndptool for sending and receiving NDP messages.

Security Fix(es):

It was found that libndp did not properly validate and check the origin of Neighbor Discovery Protocol (NDP) messages. An attacker on a non-local network could use this flaw to advertise a node as a router, allowing them to perform man-in-the-middle attacks on a connecting client, or disrupt the network connectivity of that client. (CVE-2016-3698)

Record
MGASA-2016-0185
Updated
2026-11-02
OSVopenSUSE-SU-2024:10042-1No score

libndp-1.6-2.3 on GA media

These are all security issues fixed in the libndp-1.6-2.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10042-1
Updated
2026-11-02
OSVUSN-2980-1No score

libndp vulnerability

Julien Bernard discovered that libndp incorrectly performed origin checks when receiving Neighbor Discovery Protocol (NDP) messages. A remote attacker outside of the local network could use this issue to advertise a node as a router, causing a denial of service, or possibly to act as a machine-in-the-middle.

Record
USN-2980-1
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 15 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open