CVE-2026-102718
hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed…
- Risk score
- 62/100
- CVSS
- 8.7 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- hey, _nx_snmp_utility_object_id_get in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the pars…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.7 high
- Remotely exploitable without logging in
References
Original description
hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon does not validate the claimed OID data length against the actual buffer size when the OID uses BER multibyte length encoding, so a remote attacker can send a crafted SNMP packet with a multibyte OID length larger than the available buffer, causing the parser to read past the packet buffer boundary into adjacent heap memory. the OOB bytes are decoded as OID component values and written into the agents internal OID string buffer, corrupting agent state. on systems with memory protection the OOB read poses the risk of crashing the SNMP agent thread, causing denial of service. on bare metal embedded systems without memory protection the read silently succeeds and corrupts the agents internal state with heap data.
Last activity 29 Sep 2026. Patch Forecast updates every hour.