Loading story…
A critical vulnerability (CVE-2025-68615) has been identified in the Net-SNMP snmptrapd daemon, which can be exploited by sending a specially crafted packet to cause a buffer overflow and crash the service. The flaw affects versions prior to 5.9.5 and 5.10.pre2, and has been addressed in these patched releases. The vulnerability is remotely exploitable and does not require authentication, making it a significant risk for organizations running affected versions of Net-SNMP.
Technical analysis reveals that the vulnerability stems from improper validation of user-supplied data length before copying it to a fixed-length stack-based buffer within the snmptrapd service, which listens on UDP port 162 by default. Successful exploitation allows remote attackers to execute arbitrary code in the context of the service account. Net-SNMP has released security updates to mitigate this issue, and users are strongly advised to upgrade to the latest versions to protect their systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2025-68615 was publicly disclosed as a critical vulnerability in Net-SNMP's snmptrapd daemon with a CVSS 3.1 score of 9.8. Advisories described it as a stack-based/buffer overflow remotely exploitable without authentication or user interaction.
Net-SNMP released updates addressing CVE-2025-68615 in versions 5.9.5 and 5.10.pre2. The flaw affects earlier versions of snmptrapd and can lead to denial of service or possible remote code execution via crafted packets sent to UDP port 162.
The Net-SNMP snmptrapd buffer overflow vulnerability later assigned CVE-2025-68615 was reported on July 25, 2025. The issue was credited to buddurid and involved improper length validation that could enable remote, unauthenticated exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourcezerodayinitiative.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical security vulnerability, CVE-2025-20352, has been identified in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE software, affecting a wide range of Cisco networking devices. This stack overflow flaw allows remote attackers with valid SNMP credentials to send specially crafted SNMP packets over IPv4 or IPv6, potentially causing denial-of-service (DoS) by forcing device reloads or, in more severe cases, enabling remote code execution as root. The vulnerability impacts all SNMP versions (v1, v2c, v3) and has been confirmed to affect both legacy and modern modular Cisco operating systems, including Meraki MS390 and Catalyst 9300 Series Switches running Meraki CS 17 and earlier. Reports indicate that up to 2 million devices globally, including those operated by ISPs and cloud providers, are potentially exposed to this vulnerability. The flaw was discovered during a Cisco Technical Assistance Center (TAC) support case and has already been exploited in the wild, prompting its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 29th, 2025. The exploitation of this vulnerability represents a significant escalation, as attackers have demonstrated the ability to gain administrator-level credentials and full device compromise. Rockwell Automation has issued an advisory confirming that its Lifecycle Services, specifically the Industrial Data Center (IDC) with Cisco Switching (Generations 1–5), are affected by this vulnerability. Rockwell has provided guidance on corrected software versions and available workarounds to mitigate the risk. The vulnerability poses a substantial threat to the backbone of enterprise, industrial, and service provider networks, given the widespread deployment of affected Cisco devices. Cisco’s response to the incident was initiated only after evidence of active exploitation emerged, underscoring the urgency of patching and mitigation. Organizations are strongly advised to update to the corrected Cisco software versions as soon as possible and to implement any recommended workarounds to reduce exposure. The incident highlights the ongoing risks associated with SNMP-enabled network infrastructure and the importance of credential management and network segmentation. Security teams should prioritize the identification of vulnerable devices and monitor for signs of exploitation. The rapid exploitation and large attack surface associated with CVE-2025-20352 make it a high-priority threat for organizations relying on Cisco networking equipment.
Jun 29, 2026
A critical vulnerability tracked as **CVE-2026-32746** was disclosed in **GNU InetUtils `telnetd`** affecting version **2.7 and earlier**, enabling **pre-authentication remote code execution** through a buffer overflow in the **LINEMODE SLC handler**. The flaw stems from a missing bounds check in the `add_slc` function, which can trigger an out-of-bounds memory write during the Telnet handshake before the login prompt is shown. Security reporting said a remote unauthenticated attacker could exploit the bug to execute code as **root**, resulting in full system compromise. The issue was rated **CVSS 9.8** and public proof-of-concept exploit code was reported as available, increasing the likelihood of exploitation against exposed Telnet services. Advisories urged organizations to treat internet-accessible `telnetd` instances as high risk and apply mitigations until patches are available, including restricting access to trusted IP addresses, blocking **TCP port 23**, or disabling Telnet entirely where it is not operationally required.
Jul 24, 2026
Two critical vulnerabilities have been discovered in Cisco's Snort 3 detection engine, affecting a wide range of Cisco products including Cisco Secure Firewall Threat Defense, open-source Snort 3, Cisco IOS XE with Unified Threat Defense, and Cisco Meraki appliances. These flaws, identified as CVE-2026-20026 and CVE-2026-20027, stem from improper handling of Distributed Computing Environment/Remote Procedure Call (DCE/RPC) requests, allowing unauthenticated remote attackers to either disrupt packet inspection services or extract sensitive information from affected systems. The vulnerabilities are particularly concerning for organizations running Snort 3 on Cisco Secure FTD releases 7.0.0 and later, where Snort 3 is enabled by default, significantly expanding the attack surface. The first vulnerability (CVE-2026-20026) is a use-after-free condition that can trigger denial of service by causing unexpected engine restarts, while the second (CVE-2026-20027) is an out-of-bounds read that could lead to sensitive data leakage. Cisco has released software updates to address these issues, but no workarounds are available. The vulnerabilities can be exploited by sending specially crafted DCE/RPC requests through monitored network connections, and no authentication is required for exploitation, making internet-facing systems especially at risk. Organizations are urged to apply the available patches promptly to mitigate potential threats.
Jun 29, 2026