net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.

handleipDefaultTTL in agent/mibgroup/ip-mib/ipscalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.

handleipv6IpForwarding in agent/mibgroup/ip-mib/ipscalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.

It was reported [1],[2]that the AgentX subagent of net-snmp could be stalled when a manager sent a multi-object request with a different number subids. This could lead to a denial of service.

This has been corrected upstream in version 5.4.4 [3]; only earlier versiona are affected. This means that Fedora and Red Hat Enterprise Linux 6 are not affected, however Red Hat Enterprise Linux 5 does ship a vulnerable version (5.3.x).

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684388 [2] http://seclists.org/oss-sec/2014/q1/513 [3] http://sourceforge.net/p/net-snmp/patches/1113/

Statement:

This issue did not affect the version of the net-snmp packages as shipped with Red Hat Enterprise Linux 6.

A remote denial-of-Service flaw was found in the way snmptrapd handled trap requests with empty community string, when the perl handler was enabled. A remote attacker could use this flaw to cause snmp to crash.

More details about the flaw is available at: https://bugzilla.redhat.com/showbug.cgi?id=1072044

Proposed upstream patch: http://sourceforge.net/p/net-snmp/patches/1275/

The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors.

A possibility of sensitive host information disclosure was found in the implementation of SNMP protocol as defined in RFC 1065, RFC 1066, and RFC 1067. If the snmpd deamon was running on the host, it served the SNMP queries regardless of the fact, the IP address of the requester was not mentioned in the list of hosts allowed to issue / request SNMP MIB objects information. Remote attacker could use this flaw to gain host related sensitive information via performing a SNMP query.

References: http://bugs.gentoo.org/showbug.cgi?id=250429

Upstream patch: http://net-snmp.svn.sourceforge.net/viewvc/net-snmp?view=rev&revision=17367

Net-SNMP before 5.0.9 allows a user or community to access data in MIB objects, even if that data is not allowed to be viewed.

Integer overflow in the netsnmpcreatesubtreecache function in agent/snmpagent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attackers to cause a denial of service (crash) via a crafted SNMP GETBULK request, which triggers a heap-based buffer overflow, related to the number of responses or repeats.

Unspecified vulnerability in Net-SNMP 5.3 before 5.3.0.1, when configured using the rocommunity or rouser snmpd.conf tokens, causes Net-SNMP to grant write access to users or communities that only have read-only access.

An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver. The deployment insecurely provisions the private SNMP community string with read/write access by default. Because the SNMP agent runs as root, an unauthenticated remote attacker can utilize NET-SNMP-EXTEND-MIB directives, abusing the fact that the system runs a vulnerable version of net-snmp pre 5.8, to execute arbitrary operating system commands with root privileges.

https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq advises: Net-SNMP snmptrapd vulnerability

hardaker published GHSA-4389-rwqf-q9gq Dec 22, 2025

Package: Net-SNMP Affected versions: All Patched versions: 5.9.5, 5.10.pre2

Description ===========

Impact ------- A specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash.

Patches ------- Users of Net-SNMP's snmptrapd should upgrade immediately to Net-SNMP 5.9.5 or 5.10.pre2.

Other workarounds -----------------

SNMP ports should never be open to public networks. There is no mitigation available other than ensuring ports to snmptrapd are appropriately firewalled or by upgrading to the most recent versions of the Net-SNMP software: 5.9.5 or 5.10.pre2.

CVE Identifier -------------- This has been assigned a CVE identifier of CVE-2025-68615.

Credits ------- This vulnerability was discovered by: buddurid working with Trend Micro Zero Day Initiative

Severity: Critical 9.8 / 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H https://www.zerodayinitiative.com/advisories/ZDI-25-1181/ further notes: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Net-SNMP. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the SnmpTrapd service, which listens on UDP port 162 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Net-SNMP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SnmpTrapd service, which listens on UDP port 162 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Net-SNMP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SnmpTrapd service, which listens on UDP port 162 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.

It was discovered that the snmppduparse() function could leave incompletely parsed varBind variables in the list of variables in case the parsing of the SNMP PDU failed. If later processing tries to operate on the stale and incompletely processed varBind (e.g. when printing the variables), this can lead to e.g. crashes or, possibly, execution of arbitrary code (although I've only seen NULL pointer dereferences during my testing, I currently can't rule out code execution completely).

The snmppduparse() function stores varBind variables in a list of netsnmpvariablelist structures. Each time the function parses a new varBind, a new netsnmpvariablelist item is allocated on the heap and linked to the list of variables. The problem is that this item is not removed from the list, even if snmppduparse() fails to complete the parsing.

The "type" member of the stale netsnmpvariablelist is not properly initialized in case snmppduparse() returns early from the parsing. However, the "type" member is used to determine later code paths, which is why we see crashes in a variety of functions, although the root cause for all of these is the same.

References:

Upstream patch: https://sourceforge.net/p/net-snmp/code/ci/f23bcd3ac6ddee5d0a48f9703007ccc738914791/

Upstream bug: https://sourceforge.net/p/net-snmp/bugs/2615/ (possibly restricted)

Reporter's mail to oss-security: http://www.openwall.com/lists/oss-security/2015/04/13/1

Last updated 25 August 2025

SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e.

snmpoidcompare in snmplib/snmpapi.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an unauthenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.

NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command execution.

setkey in agent/helpers/tablecontainer.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.

https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.

https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable can cause a NULL pointer dereference.

https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES

CVE-2022-24808 A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference

CVE-2022-24807 A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access. https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES

From https://github.com/net-snmp/net-snmp/blob/v5.9.2/CHANGES CVE-2022-24806 Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously

+5.9.2: + security: + - These two CVEs can be exploited by a user with read-only credentials: + - CVE-2022-24805 A buffer overflow in the handling of the INDEX of + NET-SNMP-VACM-MIB can cause an out-of-bounds memory access. + - CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable + can cause a NULL pointer dereference. + - These CVEs can be exploited by a user with read-write credentials: + - CVE-2022-24806 Improper Input Validation when SETing malformed + OIDs in master agent and subagent simultaneously + - CVE-2022-24807 A malformed OID in a SET request to + SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an + out-of-bounds memory access. + - CVE-2022-24808 A malformed OID in a SET request to + NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference + - CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable + can cause a NULL pointer dereference. + - To avoid these flaws, use strong SNMPv3 credentials and do not share them. + If you must use SNMPv1 or SNMPv2c, use a complex community string + and enhance the protection by restricting access to a given IP address range. + - Thanks are due to Yu Zhang of VARAS@IIE and Nanyu Zhong of VARAS@IIE for + reporting the following CVEs that have been fixed in this release, and + to Arista Networks for providing fixes.

Last updated 25 August 2025

Last updated 25 August 2025

Untrusted search path vulnerability in Net-SNMP 5.2.1.2 and earlier, on Gentoo Linux, installs certain Perl modules with an insecure DTRPATH, which could allow local users to gain privileges.

The handlevarrequests function in snmpagent.c for the SNMP daemon in the Net-SNMP (formerly ucd-snmp) package 5.0.1 through 5.0.5 allows remote attackers to cause a denial of service (crash) via a NULL dereference.