PT-2022-3838 · Net Snmp+8 · Net-Snmp+8
Nanyu Zhong
+1
·
Published
2022-02-25
·
Updated
2025-01-17
·
CVE-2022-24806
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
net-snmp versions prior to 5.9.2
Description
The issue is related to an Improper Input Validation vulnerability in net-snmp, which can be exploited by a user with read-write credentials when setting malformed OIDs in the master agent and subagent simultaneously. This can allow a remote attacker to execute arbitrary actions. Users should use strong SNMPv3 credentials and avoid sharing them. For those who must use SNMPv1 or SNMPv2c, using a complex community string and restricting access to a given IP address range can enhance protection.
Recommendations
For versions prior to 5.9.2, update to version 5.9.2 or later to patch the vulnerability.
As a temporary workaround, consider using strong SNMPv3 credentials and avoiding shared credentials.
Restrict access to a given IP address range to minimize the risk of exploitation for users of SNMPv1 or SNMPv2c.
Use a complex community string for additional protection when using SNMPv1 or SNMPv2c.
Exploit
Fix
SQL injection
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Net-Snmp