Description

Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated blocking read without timeout on newly accepted connections. An unauthenticated remote client can connect to the SMUX listener and send no data, causing the single-threaded snmpd main loop to block indefinitely and suspend all SNMP processing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T11:16:58.040Z",
  "pubdate": "2026-09-11T11:16:58.040Z",
  "executiveSummary": "Net-SNMP versions up to 5.9.5.2 are susceptible to a Denial of Service (DoS) vulnerability located within the SMUX (SNMP Multiplexing) protocol module.\nThe vulnerability stems from an insecure implementation of the smux_accept() function, which performs an unauthenticated blocking read operation on incoming connections without an associated timeout mechanism.\nAn unauthenticated, remote attacker can exploit this by establishing a connection to the SMUX listener and intentionally failing to transmit any data.\nBecause the snmpd daemon operates as a single-threaded process, this blocking read causes the entire main loop to halt execution, effectively suspending all SNMP processing capabilities for the target system.\nThe attack requires only network access to the SMUX port and does not necessitate valid authentication or elevated privileges, making it trivial to execute against exposed SNMP services.\nThe primary risk is a total cessation of monitoring and management functionality, which can significantly impact service availability in environments relying on SNMP for infrastructure oversight.",
  "technicalDetails": "The vulnerability resides in the SMUX (RFC 1227) implementation within the Net-SNMP daemon (snmpd). SMUX is designed to allow external processes to act as SNMP agents by multiplexing requests through the primary daemon.\nThe root cause is identified as an architectural flaw in the connection handling logic within smux_accept(). Upon accepting a new socket connection, the process enters a blocking read state to await protocol initialization data. Crucially, this read operation is performed synchronously without implementing a timeout or non-blocking I/O multiplexing, such as select() or poll().\nThe attack flow follows a straightforward pattern: 1) The attacker initiates a standard TCP connection to the SMUX listener port (typically TCP/199). 2) The snmpd process executes smux_accept() to acknowledge the connection. 3) The process enters the vulnerable blocking read state while waiting for the client to send expected SMUX protocol packets. 4) The attacker deliberately sends zero bytes of data, effectively leaving the connection open but idle.\nBecause snmpd functions as a single-threaded entity, the main loop remains trapped in the blocked read operation for the duration of the attacker's connection. This serialization ensures that the daemon cannot process legitimate incoming SNMP requests, timer-driven events, or other SNMP sub-agent communications. The daemon ceases all functions until the blocking connection is terminated by the host or a timeout is reached at the operating system layer, though the application itself provides no internal protection against this state.\nThe exposure is strictly remote; any attacker capable of establishing a TCP connection to the SMUX listener can trigger this state. No authentication or specific packet structure beyond the TCP handshake is required. Post-exploitation, the impact is a complete disruption of the SNMP service, rendering the device or server unmanageable via SNMP protocols until the process is restarted or the blocking connection is forcibly closed.\nAffected versions include all releases of Net-SNMP up to and including 5.9.5.2. The vulnerability reflects a failure to adhere to secure socket programming practices in a concurrent-ready environment where blocking operations must never be allowed to stall the primary event loop of a daemon."
}