CVE-2022-44793: Net-SNMP NULL pointer dereference in IPv6 forwarding MIB handler

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated crash of a widely deployed management daemon with public exploit references and very high EPSS, though impact is limited to denial of service.

What it is

Net-SNMP versions 5.4.3 through 5.9.3 contain a NULL pointer dereference in handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c. A remote attacker can send a crafted UDP packet that crashes the SNMP instance, causing a denial of service. The flaw affects the SNMP agent daemon and any product embedding the vulnerable Net-SNMP code.

Impact

An attacker can crash the SNMP agent process, disrupting monitoring and management of the affected host or appliance. No code execution, data disclosure or integrity impact is described; the effect is availability loss.

Attack surface

Reachable over the network via SNMP UDP traffic to the agent; the CVSS vector indicates no privileges required but user interaction is required, which is unusual for a UDP packet flaw and may reflect the crafted request needing a specific trigger. No authentication requirement is stated in the vector.

Exploitation

Not listed in CISA KEV, but public exploit references exist (gist and GitHub issue tagged Exploit) and EPSS is 0.5346 at the 98.9th percentile, indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Net-SNMP to a version later than 5.9.3 or apply the vendor patch for the affected branch.
• Apply Debian LTS and NetApp advisories for affected packages and appliances.
• Restrict SNMP UDP access to trusted management networks and disable SNMP where not required.
• Use SNMPv3 with authentication and encryption, and avoid exposing the agent to untrusted networks.

Detection

• Monitor for SNMP agent process crashes or restarts correlated with inbound UDP/161 traffic.
• Alert on malformed or unexpected SNMP requests targeting IPv6 forwarding MIB objects.
• Track Net-SNMP daemon logs for NULL pointer or segfault entries following SNMP requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.