EUVD-2026-101805
GHSA-x4j4-8wmh-mhx8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SNMP Trap Multiplexer over network
-
DeliverySend crafted malformed trap/input
-
ExploitOverflow stack buffer (CWE-121)
-
ExecutionCorrupt process memory
-
ImpactCrash service (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the HPE NonStop SNMP Trap Multiplexer service (the SNMP trap-handling component) running version T1041L01^BAA or earlier; per CVSS AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or special configuration is stated as necessary beyond the service being deployed and exposed. Limiting factors: HPE NonStop is a specialized, mission-critical platform typically deployed in segmented enterprise/telecom/financial environments, so network exposure is often restricted; impact is vendor-scored as availability-only (service crash), so the practical worst case is denial of service of trap multiplexing rather than data compromise. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, unauthenticated, low-complexity flaw whose ONLY impact is availability (C:N/I:N/A:H) - consistent with a stack-based buffer overflow (CWE-121) causing memory corruption that crashes the SNMP Trap Multiplexer rather than yielding code execution or data disclosure. No EPSS score, KEV listing, or POC indicator was supplied in the input, so exploitation likelihood cannot be quantified from the data; status is therefore 'no public exploit identified at time of analysis.' This tempers the otherwise concerning network/unauthenticated profile: the 7.5 rating is driven entirely by availability loss on a niche HPE NonStop component, not by RCE. Note a tension worth flagging: CWE-121 stack overflows CAN sometimes escalate to code execution, yet HPE scored impact as availability-only - treat the A:H-only assessment as vendor-stated and verify with HPE advisory hpesbns05148en_us whether memory corruption is exploitable beyond a crash. Net: a legitimate patch-worthy DoS exposure, but absent EPSS/KEV/POC signals this is a moderate priority rather than an emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to the HPE NonStop SNMP Trap Multiplexer sends a specially crafted SNMP trap or malformed network input that overflows a stack buffer, corrupting memory and crashing the service. Given AV:N/AC:L/PR:N, no authentication or user interaction is required; the realistic outcome per the vendor's availability-only scoring is denial of service of trap processing. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Stack-based memory corruption in the HPE NonStop SNMP Trap Multiplexer (T1041L01^BAA and earlier) lets remote, unauthenticated attackers crash the trap-handling service, producing a denial-of-service condition on the SNMP trap collection path. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms network reachability with no authentication, privileges, or user interaction required, but limits impact strictly to availability - there is no assessed loss of confidentiality or integrity, so code execution or data disclosure is not established by the available evidence. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the practical risk is therefore a remotely triggerable service crash on a specialized, typically network-segmented platform.
RemediationAI
The provided intelligence does not include an exact fixed version, a patched-release tag, or a GitHub PR/commit, so the status is: no vendor-released patch identified from the available data at time of analysis. The primary action is to open HPE security bulletin hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US) and apply the NonStop RVU or SPR/PAK that HPE specifies there for T1041L01^BAA and earlier, then verify the multiplexer version after installation. Until a fix is applied, the most effective compensating control is network segmentation: permit inbound trap traffic to the SNMP Trap Multiplexer only from explicitly enumerated management-station and agent addresses via host-based ACLs, NonStop IP firewall rules, or upstream routers/firewalls. The trade-off is operational - legitimate traps from any source not on the allowlist are silently dropped, so the list must be maintained as monitoring infrastructure changes and should be logged so that unexpected drops are visible. If the multiplexer is not required, stopping or disabling the service removes the attack surface entirely, at the cost of losing centralized trap collection and the alerting that depends on it. Where the service must remain open, isolate it in a dedicated management VLAN with no route to production or administrative networks, and monitor the host for repeated abnormal process terminations or restart events as an indicator of attempted exploitation. Because the assessed impact is availability-only, tested and rehearsed restart/recovery procedures for the multiplexer provide resilience, though they do not prevent the crash itself.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stack-based buffer overflow (CWE-121) in the SNMP Trap Multiplexer component shipped with HPE NonStop. CWE-121 denotes a fixed-length stack buffer receiving more data than it can hold, without bounds checking before the write, which corrupts adjacent stack memory (saved frame pointers, return addresses, or local variables) and generally terminates the process. SNMP traps are unsolicited, asynchronous notifications pushed from agents to a collector, so the vulnerable parsing path is reached simply by delivering a crafted or malformed trap packet to the multiplexer service; in conventional SNMP deployments this is the trap-listener port (UDP 162), though the input data confirms only the component name, not the specific listener configuration. The CPE cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_snmp_trap_multiplexer:*:*:*:*:*:*:*:* carries a wildcard version, so version scoping must come from the EUVD data, which pins affected releases at T1041L01^BAA and earlier. Because the assessed impact is C:N/I:N/A:H, the observable effect is expected to be memory corruption resulting in a crash/restart of the multiplexer rather than a controlled-write primitive exploited for remote code execution; however, memory-corruption classes are frequently exploitable beyond a simple denial of service if the corrupted structure is reachable, so the availability-only scoring should be treated as the vendor's assessed worst case rather than a guarantee that no further impact is attainable.
Know when Hpe Nonstop Snmp Trap Multiplexer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated SNMP service (AV:N/PR:N/UI:N), low-complexity stack overflow causing a crash, so availability-only (A:H, C:N/I:N) matching vendor scoring.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption
Executive ViewAI
HPE NonStop SNMP Trap Multiplexer (T1041L01^BAA and earlier) contains a stack-based memory corruption vulnerability that allows remote, unauthenticated attackers to crash the trap-handling service, disrupting SNMP trap collection and operational monitoring on affected NonStop systems. No public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so the immediate business risk is availability and monitoring visibility rather than data compromise. Leadership should care because a crash on the trap collection path can blind operations to other incidents, although confidentiality and integrity are not assessed as impacted.
No vendor-released patch identified at time of analysis; restrict network access to the SNMP Trap Multiplexer to trusted management stations via firewall/ACL or management VLAN segmentation, disable or stop the trap-handling service if not operationally required, monitor logs and service health for unexpected crashes and trap-collection interruptions, and maintain alternate monitoring paths while mitigation is in place.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB