CVE-2022-44792: Net-SNMP NULL pointer dereference in ipDefaultTTL handler causes DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityThe flaw is a remotely reachable crash with public exploit references and high EPSS, but it requires write access and only causes denial of service, with no KEV listing.

What it is

Net-SNMP 5.8 through 5.9.3 contains a NULL pointer dereference in handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c. A remote attacker with write access can send a crafted UDP packet that crashes the SNMP instance, causing a denial of service. The flaw is a straightforward crash bug rather than memory corruption, so the primary risk is availability loss on exposed SNMP agents.

Impact

An attacker can crash the Net-SNMP agent process, disrupting monitoring and management of the affected host until it is restarted. No confidentiality or integrity impact is described; the effect is availability only.

Attack surface

Reached over the network via SNMP UDP traffic against the ipDefaultTTL MIB object; the CVSS vector indicates no privileges are required but user interaction is required, and the description states the attacker needs write access to the object. The record does not specify which SNMP version or community/credential configuration is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.52 (99th percentile), and two references are tagged Exploit, indicating public proof-of-concept material exists. No ransomware usage is documented.

What to do

• Upgrade Net-SNMP to a release newer than 5.9.3 that contains the fix, or apply the vendor patch for your distribution.
• Restrict SNMP write access by using read-only community strings or SNMPv3 users without write permissions where possible.
• Block or filter UDP port 161 from untrusted networks and limit SNMP exposure to management subnets.
• Monitor the SNMP agent process and configure automatic restart so a crash does not cause prolonged monitoring gaps.

Detection

• Alert on unexpected termination or restart of snmpd processes on monitored hosts.
• Watch for repeated or malformed SNMP SET requests targeting the ipDefaultTTL OID from unusual sources.
• Correlate SNMP agent crash logs or core dumps with inbound UDP/161 traffic spikes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.