CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2022-24806
Medium (5.3). EPSS 1.1% chance of exploitation in the next 30 days.
net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an Improper Input Validation vulnerability when SETing malformed OIDs in master agent and subagent simultaneously. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fedoraproject:fedora
- net-snmp:net-snmp
- redhat:enterprise_linux
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_for_arm_64
- redhat:enterprise_linux_for_arm_64_eus
- redhat:enterprise_linux_for_ibm_z_systems
- redhat:enterprise_linux_for_ibm_z_systems_eus
- redhat:enterprise_linux_for_power_little_endian
- redhat:enterprise_linux_for_power_little_endian_eus
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- redhat:enterprise_linux_server_update_services_for_sap_solutions
- redhat:enterprise_linux_update_services_for_sap_solutions
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2103225
- https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775
- https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/
- https://security.gentoo.org/glsa/202210-29