Net-SNMP CVE-2025-68615

The affected component is the net-snmp SNMP agent/library (fixed in Alpine at 5.9.5.2-r0; also tracked for Debian 11). Exploitation requires network reachability to an SNMP service (default UDP/161) or processing of attacker-influenced SNMP data by net-snmp's parsing code. LIMITING FACTORS: the NVD entry provides no technical detail, so the precise trigger is unconfirmed - net-snmp buffer overflows frequently require a valid community string or authenticated SNMP query, and SNMP is often firewalled to management networks rather than internet-exposed, both of which would sharply reduce realistic exposure despite the AV:N/PR:N rating. Confirm the exact precondition against advisory GHSA-4389-rwqf-q9gq before assuming default-config unauthenticated exploitation.

Signals conflict in a way that should temper the raw 9.8 score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) describes a remote, unauthenticated, low-complexity memory-corruption flaw (CWE-119) with full CIA impact in net-snmp - on paper a top-priority critical. However, the EPSS score is only 0.42% (62th percentile), which is modest and indicates no observed mass-exploitation signal, and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. A detection script and a mitigation script are publicly hosted by Vicarius, so publicly available exploit/tooling code exists, but POC tooling is a distinct signal from active in-the-wild use. The single most important caveat is data quality: the NVD description is a bare Alpine fix notice ('net-snmp fixed in 5.9.5.2-r0') with NO technical detail on the vulnerable code path, so the PR:N / AC:L claims cannot be independently validated against a described attack - many historical net-snmp buffer overflows require a valid SNMP community string or authenticated agent access, which would raise privileges required. Net: treat as a high-priority patching item because net-snmp is broadly deployed and the flaw is memory corruption with public tooling, but the low EPSS, absence from KEV, and unverified unauthenticated-remote assumption argue this is not yet a confirmed widespread-exploitation emergency - verify the exact trigger (agent packet vs. authenticated query) with the GHSA advisory before assuming default-config remote unauth RCE.

An attacker reachable to the SNMP service sends a crafted SNMP request/response that overflows a buffer in net-snmp's parsing code, corrupting memory to crash the agent (DoS) or potentially execute code in the service's context. Public detection and mitigation scripts from Vicarius exist, lowering the bar to identify vulnerable hosts, though no weaponized RCE exploit or active exploitation is confirmed. Realistic impact and whether a valid community string is needed depend on the specific vulnerable code path, which the advisory (GHSA-4389-rwqf-q9gq) rather than the NVD stub must confirm.