CVE-2015-5621Net-Snmp Integer Overflow
net-snmp - security update
Published Feb 11, 2022 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2015-5621, DLA-1317-1, DSA-4154-1, SUSE-SU-2015:1524-1, SUSE-SU-2015:1556-1, TR-22-0132, UBUNTU-CVE-2015-5621
Key Facts
Patch immediately- CVE-2015-5621 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Net-Snmp, net-snmp-devel (amazon), net-snmp-libs (amazon) and 14 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 41% probability of exploitation in the next 30 days.
- Fixed versions are available, including libsnmp15 5.4.2.1-8.12.24.1, libsnmp15-32bit 5.4.2.1-8.12.24.1, libsnmp15-x86 5.4.2.1-8.12.24.1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
41%
Higher than 98.6% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
43/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
Description
The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.
Affected Products
123 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Net-SnmpNet-Snmp | See advisory | 5.7.2 |
| net-snmp-develamazon | See advisory | 1:5.5-54.1.20.amzn1 |
| net-snmp-libsamazon | See advisory | 1:5.5-54.1.20.amzn1 |
| net-snmp-perlamazon | See advisory | 1:5.5-54.1.20.amzn1 |
| net-snmp-pythonamazon | See advisory | 1:5.5-54.1.20.amzn1 |
Patched Releases
libsnmp15
5.4.2.1-8.12.24.1
libsnmp15-32bit
5.4.2.1-8.12.24.1
libsnmp15-x86
5.4.2.1-8.12.24.1
libsnmp30
5.7.2.1-4.3.2, 5.7.3-8.4
libsnmp30-32bit
5.7.2.1-4.3.2, 5.7.3-8.4
Net-Snmp
1:5.5-54.0.1.el6_7.1, 1:5.5-54.1.20.amzn1, 1:5.5-54.el6_7.1, 1:5.7.2-20.ael7b_1.1, 1:5.7.2-20.el7_1.1, 5.4.2.1-8.12.24.1, 5.4.3~dfsg-2.8+deb7u2, 5.7.2.1-4.3.2, 5.7.2.1+dfsg-1+deb8u1, 5.7.2~dfsg-8.1ubuntu3.1, 5.7.3-8.4, 5.7.3+dfsg-1.1, 5.8-1, 5.7.2
net-snmp-agent-libs
1:5.7.2-20.el7_1.1
net-snmp-devel
1:5.5-54.0.1.el6_7.1, 1:5.5-54.1.20.amzn1, 1:5.7.2-20.el7_1.1, 5.4.2.1-8.12.24.1, 5.7.2.1-4.3.2, 5.7.3-8.4
net-snmp-devel-32bit
5.4.2.1-8.12.24.1, 5.7.3-8.4
net-snmp-gui
1:5.7.2-20.el7_1.1
net-snmp-libs
1:5.5-54.0.1.el6_7.1, 1:5.5-54.1.20.amzn1, 1:5.7.2-20.el7_1.1
net-snmp-perl
1:5.5-54.0.1.el6_7.1, 1:5.5-54.1.20.amzn1, 1:5.7.2-20.el7_1.1
net-snmp-python
1:5.5-54.0.1.el6_7.1, 1:5.5-54.1.20.amzn1, 1:5.7.2-20.el7_1.1, 5.7.3-8.4
net-snmp-sysvinit
1:5.7.2-20.el7_1.1
net-snmp-utils
1:5.5-54.0.1.el6_7.1, 1:5.5-54.1.20.amzn1, 1:5.7.2-20.el7_1.1
perl-SNMP
5.4.2.1-8.12.24.1, 5.7.2.1-4.3.2, 5.7.3-8.4
snmp-mibs
5.4.2.1-8.12.24.1, 5.7.2.1-4.3.2, 5.7.3-8.4
Timeline
Publicly disclosed
Feb 11, 2022
Last updated
Aug 4, 2026
Weakness Type
- CWE-19
- CWE-190 Integer Overflow or Wraparound
- CWE-665 Improper Initialization
- CWE-672 Operation on a Resource after Expiration or Release
- CWE-772 Missing Release of Resource after Effective Lifetime
- CWE-909 Missing Initialization of Resource
References
- advisorysecurity-tracker.debian.org · CVE-2015-5621
- advisoryubuntu.com · CVE-2015-5621
- advisorycve.org · CVERecord
- advisoryweb.nvd.nist.gov · vuln
- advisoryRHSA-2015:1636
FAQ
Common Questions.
The snmp_pdu_parse function in snmp_api.c in net-snmp 5.7.2 and earlier does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted packet.
Affected: Net-Snmp; net-snmp-devel (amazon); net-snmp-libs (amazon), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including libsnmp15 5.4.2.1-8.12.24.1, libsnmp15-32bit 5.4.2.1-8.12.24.1, libsnmp15-x86 5.4.2.1-8.12.24.1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2015-5621 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo