CVE-2025-68615

CVE-2025-68615 is a buffer overflow (CWE-119) in net-snmp, a widely used SNMP application library, tool suite, and daemon. An attacker triggers it by sending a specially crafted SNMP packet to a host running the snmptrapd trap-receiving daemon, with no authentication or user interaction required (AV:N/AC:L/PR:N). The documented outcome is a buffer overflow that crashes the daemon (denial of service); the critical CVSS 9.8 rating reflects potential high-impact memory corruption, though no confirmed remote code execution is described in the available data. Any deployment running net-snmp versions prior to 5.9.5 or 5.10.pre2 — including the net-snmp packages shipped in Debian Linux — is affected where snmptrapd is enabled and reachable by attacker-supplied packets. The flaw is not yet listed in CISA KEV and no confirmed in-the-wild exploitation is reported in this data, but a public detection script exists and EPSS estimates a 42.8% probability of exploitation within 30 days (99th percentile).

What to do: Upgrade to net-snmp 5.9.5 or 5.10.pre2, or apply the backported security update provided by your distribution (e.g., Debian security updates), since distro packages may be affected even if they carry a pre-5.9.5 version. Determine whether snmptrapd is actually running (e.g., check systemctl status snmptrapd or process list) and disable it if not needed; otherwise restrict inbound access to the trap-receiving port (default UDP 162) with firewall rules as an interim mitigation. Monitor EPSS and vendor advisories, as the ~43% probability of exploitation within 30 days could rise quickly given a public proof-of-concept detection is already available.