CVE-2022-44792
MediumPublic exploitnet-snmp - security update
Published Jan 16, 2023 · Updated Aug 12, 2026 · Also known as ALPINE-CVE-2022-44792, DEBIAN-CVE-2022-44792, DLA-3270-1, DLA-4381-1, SUSE-SU-2023:0068-1, SUSE-SU-2023:0075-1, UBUNTU-CVE-2022-44792, USN-5795-1
Key Facts
Patch immediately- CVE-2022-44792 is a medium-severity vulnerability (CVSS 6.5 v3.1) affecting Net-Snmp, Debian Linux, H300s Firmware (Netapp) and 16 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 52% probability of exploitation in the next 30 days.
- Fixed versions are available, including libsnmp30 5.7.3-11.6.1, libsnmp30-32bit 5.7.3-11.6.1, libsnmp40 5.9.3-150300.15.8.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
52%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2022-44792 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
Affected Products
110 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Net-SnmpNet-Snmp | See advisory | 5.9.3 |
| Debian LinuxDebian | 10.0 | n/a |
| H300s FirmwareNetapp | See advisory | n/a |
| H410s FirmwareNetapp | See advisory | n/a |
| H500s FirmwareNetapp | See advisory | n/a |
Patched Releases
libsnmp30
5.7.3-11.6.1
libsnmp30-32bit
5.7.3-11.6.1
libsnmp40
5.9.3-150300.15.8.1
libsnmp40-32bit
5.9.3-150300.15.8.1
Net-Snmp
1:5.8-27.0.1.el8, 1:5.8-27.el8, 1:5.9.1-9.0.1.el9, 1:5.9.1-9.el9, 5.7.2~dfsg-8.1ubuntu3.3+esm3, 5.7.3-11.6.1, 5.7.3+dfsg-1.8ubuntu3.8, 5.7.3+dfsg-1ubuntu4.6+esm1, 5.7.3+dfsg-5+deb10u4, 5.8-10.ph3, 5.8-10.ph4, 5.8+dfsg-2ubuntu2.6, 5.9.1+dfsg-1ubuntu2.4, 5.9.3-150300.15.8.1, 5.9.3-2.ph5, 5.9.3-r1, 5.9.3-r2, 5.9.3-r3, 5.9.3+dfsg-2, 5.9.4-1, 5.9+dfsg-4+deb11u2, <=5.9.3
net-snmp-agent-libs
1:5.8-27.0.1.el8, 1:5.9.1-9.0.1.el9
net-snmp-devel
1:5.8-27.0.1.el8, 1:5.9.1-9.0.1.el9, 5.7.3-11.6.1, 5.8-10.ph4, 5.9.3-150300.15.8.1, 5.9.3-2.ph5
net-snmp-devel-32bit
5.9.3-150300.15.8.1
net-snmp-libs
1:5.8-27.0.1.el8, 1:5.9.1-9.0.1.el9
net-snmp-perl
1:5.8-27.0.1.el8, 1:5.9.1-9.0.1.el9, 5.8-10.ph4, 5.9.3-2.ph5
net-snmp-utils
1:5.8-27.0.1.el8, 1:5.9.1-9.0.1.el9
perl-SNMP
5.7.3-11.6.1, 5.9.3-150300.15.8.1
python3-net-snmp
1:5.9.1-9.0.1.el9, 5.9.3-150300.15.8.1
snmp-mibs
5.7.3-11.6.1, 5.9.3-150300.15.8.1
Timeline
Publicly disclosed
Jan 16, 2023
Last updated
Aug 12, 2026
Weakness Type
- CWE-476 NULL Pointer Dereference
References
- advisoryRHSA-2023:2444
- advisoryRHSA-2023:2969
- advisoryhttps://bugzilla.suse.com/1198059
- advisoryhttps://bugzilla.suse.com/1205148
- advisoryhttps://bugzilla.suse.com/1205150
FAQ
Common Questions.
handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
Affected: Net-Snmp; Debian Linux versions 10.0; H300s Firmware (Netapp), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including libsnmp30 5.7.3-11.6.1, libsnmp30-32bit 5.7.3-11.6.1, libsnmp40 5.9.3-150300.15.8.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-44792 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo