CVE-2022-24806mediumCWE-20

CVE-2022-24806: medium-severity vulnerability in net-snmp

net-snmp vulnerable to Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously

Published · Updated

Follow this CVE+ Monitor net-snmp+ Monitor net-snmp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.1%
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an Improper Input Validation vulnerability when SETing malformed OIDs in master agent and subagent simultaneously. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
net-snmp · net-snmp
Related CVEs — net-snmp

In the same product, most dangerous first.

CVE-2025-68615CRITICALNet-SNMP snmptrapd crashEPSS 42.4%CVE-2022-24805MEDIUMnet-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.EPSS 1.3%CVE-2022-24810MEDIUMnet-snmp: A malformed OID in a SET to the nsVacmAccessTable can cause a NULL pointer dereference.EPSS 1.2%CVE-2022-24808MEDIUMnet-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereferenceEPSS 1.1%CVE-2022-24809MEDIUMnet-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereferenceEPSS 1.1%CVE-2022-24807MEDIUMnet-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory accessEPSS 1.0%