CVE-2025-68615
📋 TL;DR
A buffer overflow vulnerability in net-snmp's snmptrapd daemon allows remote attackers to crash the service via specially crafted SNMP trap packets. This affects all systems running vulnerable versions of net-snmp with snmptrapd enabled. The high CVSS score indicates potential for remote code execution.
💻 Affected Systems
- net-snmp
📦 What is this software?
Net Snmp by Net Snmp
Net Snmp by Net Snmp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, service disruption, and potential lateral movement.
Likely Case
Denial of service through daemon crash, potentially disrupting SNMP monitoring and management.
If Mitigated
Limited to service disruption if proper network segmentation and access controls prevent exploitation.
🎯 Exploit Status
Exploitation requires sending specially crafted SNMP trap packets to the vulnerable daemon.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.9.5 or 5.10.pre2
Vendor Advisory: https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq
Restart Required: Yes
Instructions:
1. Update net-snmp to version 5.9.5 or higher. 2. For Debian/Ubuntu: apt update && apt upgrade net-snmp. 3. For RHEL/CentOS: yum update net-snmp. 4. Restart snmptrapd service.
🔧 Temporary Workarounds
Disable snmptrapd
linuxStop and disable the vulnerable snmptrapd daemon if not required.
systemctl stop snmptrapd
systemctl disable snmptrapd
Network Access Control
linuxRestrict SNMP trap port (default 162) access to trusted sources only.
iptables -A INPUT -p udp --dport 162 -s trusted_ip -j ACCEPT
iptables -A INPUT -p udp --dport 162 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate SNMP traffic.
- Deploy intrusion detection/prevention systems to monitor for SNMP exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check net-snmp version: snmptrapd -v 2>&1 | head -1Check Version:
snmptrapd -v 2>&1 | head -1Verify Fix Applied:
Verify version is 5.9.5 or higher: snmptrapd -v 2>&1 | grep -E '5\.9\.5|5\.10'📡 Detection & Monitoring
Log Indicators:
- snmptrapd crash logs in systemd journal or syslog
- Unexpected SNMP trap packets from untrusted sources
Network Indicators:
- Unusual SNMP trap traffic patterns
- Malformed SNMP packets to port 162
SIEM Query:
source="snmptrapd" AND (event="crash" OR event="segfault")🔗 References
- https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq
- http://www.openwall.com/lists/oss-security/2026/01/09/2
- https://lists.debian.org/debian-lts-announce/2026/01/msg00000.html
- https://www.vicarius.io/vsociety/posts/cve-2025-68615-detection-script-buffer-overflow-vulnerability-affecting-net-snmp
- https://www.vicarius.io/vsociety/posts/cve-2025-68615-mitigation-script-buffer-overflow-vulnerability-affecting-net-snmp
