net-snmp CVE-2025-68615

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:14 vuln.today

DescriptionCVE.org

Alpine Linux: net-snmp fixed in 5.9.5.2-r0

AnalysisAI

net-snmp on Alpine Linux received a security fix packaged as version 5.9.5.2-r0, addressing an unspecified vulnerability in the SNMP suite. The upstream vulnerability details - including the attack vector, affected component, and exploitable condition - are not disclosed in the available intelligence; only the Alpine Linux vendor advisory confirms a fix was issued. With an EPSS score of 0.42% (62nd percentile), exploitation probability is low but not negligible, suggesting the issue is real but not yet actively targeted at scale.

Technical ContextAI

net-snmp is a widely deployed open-source implementation of the Simple Network Management Protocol (SNMP), providing daemons (snmpd), libraries, and tools used for network device monitoring and management across Linux distributions. Alpine Linux packages net-snmp and issued a patched package at version 5.9.5.2-r0. No CWE classification has been published, meaning the root cause class - whether memory corruption, improper input validation, authentication bypass, or another weakness - cannot be confirmed from available data. No CPE string was provided, so the exact upstream net-snmp version range affected must be inferred from the Alpine package version alone.

Affected ProductsAI

Alpine Linux systems running net-snmp prior to the patched package version 5.9.5.2-r0 are confirmed affected per the Alpine Linux vendor advisory. The exact upstream net-snmp release versions that correspond to the vulnerable range are not independently confirmed from available data. No CPE strings were provided. Users of net-snmp on other Linux distributions should monitor upstream net-snmp project advisories separately, as this CVE entry is scoped to the Alpine Linux packaging.

RemediationAI

Update net-snmp on Alpine Linux to the patched package version 5.9.5.2-r0 or later using the standard Alpine package manager: 'apk update && apk upgrade net-snmp'. This is the primary and confirmed fix per the Alpine Linux vendor advisory. If immediate patching is not possible, compensating controls depend on the unknown attack vector - as a precaution, restrict SNMP access via firewall rules to trusted management hosts only, disable SNMPv1/v2c if not required (prefer SNMPv3 with authentication and encryption), and audit SNMP community strings for default or weak values. Note that disabling SNMP entirely will interrupt network monitoring workflows. No specific workaround has been confirmed by the vendor for this CVE, and no upstream net-snmp advisory URL is available in the provided data.