NULL Pointer Dereference Vulnerability in net-snmp Prior to 5.9.2

CVE-2022-24809

What is CVE-2022-24809?

The net-snmp suite provides essential tools for managing network devices via the Simple Network Management Protocol (SNMP). A vulnerability exists within the older versions of net-snmp prior to 5.9.2, where a read-only user can exploit a malformed Object Identifier (OID) in a GET-NEXT request directed at the nsVacmAccessTable. This exploitation may lead to a NULL pointer dereference, potentially allowing the attacker to disrupt service. Users employing SNMPv3 should ensure their credentials are robust and must avoid sharing access details. For those needing to use SNMPv1 or SNMPv2c, it is advised to implement complex community strings and restrict access by IP address range to enhance security.

References