EUVD-2026-101007
GHSA-6jv3-ccqp-xfww
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SNMP trap listener over network
-
ExploitSend crafted oversized trap packet
-
ExecutionOverflow stack buffer in multiplexer
-
ImpactCrash service or execute code as process owner
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the HPE NonStop SNMP Trap Multiplexer's trap-receiving interface and the ability to deliver a malformed SNMP trap message that triggers the stack buffer overflow; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, privileges, or user interaction are needed. Exploitation is inherently limited to environments running the HPE NonStop platform with this multiplexer component deployed and exposed - a small, specialized population (typically banking, telecom, and transaction-processing systems). Whether the trap listener is exposed by default or restricted to trusted management networks is not stated in the available data and should be confirmed with HPE. |
| Impact | Signals conflict and must be reconciled before prioritization. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, unauthenticated, low-complexity flaw with AVAILABILITY-ONLY impact (C:N/I:N/A:H) - i.e. a denial-of-service profile - yet the description and tags (RCE, Buffer Overflow, Stack Overflow) plus CWE-121 (stack-based buffer overflow) assert remote code execution, which would normally carry confidentiality and integrity impact (C:H/I:H). This is a material discrepancy: either the vendor scored only the reliably-demonstrated DoS outcome while noting RCE as a theoretical possibility ('may allow'), or the vector under-represents true impact. There is NO EPSS score, NO CISA KEV listing, and NO public exploit indicator in the provided data, so exploitation probability cannot be quantified and status is 'no public exploit identified at time of analysis.' No SSVC fields were provided. Net: a network-facing unauthenticated memory-corruption bug is inherently serious, but the only confirmed impact in the vector is availability, and real-world urgency is tempered by the narrow deployment footprint of the HPE NonStop platform and the absence of any exploitation evidence. Treat as a patch-priority item for organizations actually running NonStop, but the RCE claim should be verified against the HPE advisory before assuming full code-execution risk. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reachability to the SNMP Trap Multiplexer service sends a crafted SNMP trap containing an oversized field that overflows a stack buffer (CWE-121). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is needed; the confirmed outcome is service crash (A:H), with potential code execution as claimed in the description. No public proof-of-concept is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Remote, unauthenticated code execution is possible in the HPE NonStop SNMP Trap Multiplexer, which processes inbound SNMP trap messages on the HPE NonStop platform. An attacker who can reach the trap-receiving interface can deliver a crafted trap that overflows a stack buffer (CWE-121); our independent assessment rates the full impact as high for confidentiality, integrity and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas the vendor-published 7.5 vector reflects only an availability impact (C:N/I:N/A:H) - a conflict that must be reconciled with HPE before prioritization. Exploitation requires network reachability to the trap listener and no credentials, privileges, or user interaction (PR:N/UI:N); no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV. Exposure is confined to the specialized population running HPE NonStop with this multiplexer deployed - typically banking, telecom and transaction-processing environments - which limits the scale but not the severity of a successful attack.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis - absence of a documented fix version in the HPE bulletin is not confirmation that none exists, so verify current patch status directly against HPE Security Bulletin hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US) and request an explicit fixed-build reference from HPE support. Until a fix is confirmed, apply compensating controls: restrict the trap-receiving interface with host firewalls, ACLs, or NonStop IP-filter rules so that only known management stations and trap-forwarding collectors can reach the multiplexer's listening port - this is the highest-value mitigation because the vulnerability is only reachable when a malformed trap can be delivered, but it requires accurate inventory of legitimate trap sources and will silently drop traps from any sender omitted from the allowlist, degrading monitoring fidelity. Where the component is not strictly required, stop or disable the SNMP Trap Multiplexer service (side effect: loss of trap forwarding and downstream alerting for the affected NonStop system) and, if traps must still be collected, terminate them locally on the NonStop host rather than via the multiplexer. Segment the NonStop environment onto a dedicated management VLAN that is not reachable from general user or internet-facing networks, and monitor multiplexer process logs and NonStop EMS events for abrupt termination, core dumps, or restart loops - an availability-style symptom consistent with the vendor's C:N/I:N/A:H vector that may indicate exploitation attempts even if code execution is not achieved. Note that the vendor and independent CVSS readings disagree on confidentiality and integrity impact; plan remediation on the conservative assumption of full code execution until HPE clarifies.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a stack-based buffer overflow (CWE-121) in the HPE NonStop SNMP Trap Multiplexer, a component that receives and fans out SNMP trap notifications generated by managed devices and NonStop subsystems. SNMP trap receivers conventionally accept unsolicited datagrams on a management-facing UDP port (commonly 162), meaning the vulnerable parsing path is reachable without prior authentication or session establishment; the provided CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no privileges or user interaction are needed to reach it. The CWE-121 classification indicates the vulnerable code copies attacker-controlled trap content into a fixed-size stack buffer without adequate bounds checking, corrupting adjacent stack memory and, in the assessed worst case, subverting control flow to achieve remote code execution under the privileges of the multiplexer process. The affected product is identified by CPE cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_snmp_trap_multiplexer:*:*:*:*:*:*:*:* with a wildcard version field, indicating the advisory does not enumerate a specific vulnerable release. Note the divergence between the vendor-supplied 7.5 vector (availability-only) and the independent assessment (C:H/I:H/A:H); because a stack overflow with control-flow corruption is consistent with the higher-impact reading, the elevated assessment should be treated as authoritative pending vendor clarification, and the default/listener exposure posture of the multiplexer is not documented in the available data.
Know when Hpe Nonstop Snmp Trap Multiplexer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description and CWE-121 indicate remote unauthenticated code execution via network-delivered SNMP trap, so AV:N/AC:L/PR:N with full C/I/A impact; note vendor vector claimed availability-only.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution
Executive ViewAI
HPE NonStop customers running the SNMP Trap Multiplexer face a remotely reachable memory-corruption flaw that could let an unauthenticated attacker execute code on platforms that typically underpin high-value banking, telecom, and transaction-processing workloads. With no vendor patch yet available, leadership should treat this as a material risk to revenue-critical transaction processing and prioritize isolating exposed trap interfaces while HPE resolves the issue. A conflict between the vendor's availability-only severity rating and independent analysis indicating full confidentiality, integrity, and availability impact should be reconciled with HPE to confirm true exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the SNMP trap listener (typically UDP 162) via firewall rules or ACLs so only trusted management systems can reach it; disable or stop the SNMP Trap Multiplexer service where it is not operationally required; segment NonStop management networks from user and general-purpose networks; deploy IDS/IPS signatures or SNMP parsing checks for oversized or malformed trap payloads; monitor the HPE advisory for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB