CVE-2025-68615: 
NixOS vulnerability analysis and mitigation

CVE-2025-68615 is a critical stack-based buffer overflow vulnerability in the net-snmp snmptrapd daemon that allows unauthenticated remote attackers to crash the daemon or potentially execute arbitrary code. It was discovered by researcher "buddurid" working with Trend Micro Zero Day Initiative and publicly disclosed on December 22–23, 2025. All net-snmp versions prior to 5.9.5 and 5.10.pre2 are affected, including distributions such as Debian Linux 11.0, Microsoft Azure Linux (CBL2/AZL3 with net-snmp 5.9.4-1), and Oracle products. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, ZDI Advisory).

The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119), specifically a lack of validation of the length of user-supplied data before copying it into a fixed-length stack-based buffer within the snmptrapd service. The snmptrapd daemon listens on UDP port 162 by default, and a specially crafted SNMP packet sent to this port can trigger the overflow without any authentication or user interaction required. According to the Zero Day Initiative advisory, successful exploitation allows an attacker to execute arbitrary code in the context of the service account (oss-security, ZDI Advisory). No special preconditions beyond network reachability to the snmptrapd port are required.

Successful exploitation can result in a crash of the snmptrapd daemon (denial of service), disrupting SNMP trap processing and network monitoring capabilities across affected environments. Beyond availability, the CVSS score reflects high confidentiality and integrity impact, meaning a fully weaponized exploit could allow arbitrary code execution as the service account, potentially enabling lateral movement within the network. Organizations relying on net-snmp for infrastructure monitoring — including enterprise networks, telecom environments, and cloud platforms (Microsoft Azure Linux, Oracle products) — face significant risk of monitoring blind spots and potential system compromise (GitHub Advisory, ZDI Advisory).

Proof-of-concept exploit information is publicly available via the Zero Day Initiative advisory (ZDI-25-1181) and a detection/PoC script published on Vicarius vSociety. No confirmed in-the-wild exploitation has been reported as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.023% (0.000230), indicating a currently low probability of exploitation in the wild, though the unauthenticated network attack vector and critical CVSS score make it a high-priority patching target (ZDI Advisory, Vicarius).

1. Reconnaissance: Identify hosts running net-snmp's snmptrapd daemon using network scanners (e.g., Shodan, Censys, or nmap targeting UDP port 162). Confirm the version is prior to 5.9.5 or 5.10.pre2.
2. Craft malicious SNMP packet: Construct a specially crafted SNMP trap packet containing an oversized field that exceeds the fixed-length stack buffer in the snmptrapd message handling code. Tools such as Scapy or custom scripts can be used to build the malformed packet.
3. Send packet to target: Transmit the crafted UDP packet to the target host on port 162 (the default snmptrapd listening port). No authentication credentials are required.
4. Trigger buffer overflow: The daemon copies the user-supplied data into a fixed-length stack buffer without length validation, causing a stack-based buffer overflow.
5. Achieve objective: Depending on exploit sophistication, the outcome ranges from crashing the snmptrapd daemon (denial of service) to achieving arbitrary code execution in the context of the service account via return-oriented programming (ROP) or similar techniques (ZDI Advisory, oss-security).

• Network: Unexpected or malformed UDP packets arriving on port 162 from untrusted or external IP addresses; unusual traffic volume targeting the snmptrapd port.
• Logs: Sudden termination or crash entries for the snmptrapd process in system logs (e.g., /var/log/syslog, /var/log/messages); segmentation fault or signal 11 (SIGSEGV) entries associated with the snmptrapd process.
• Process: Unexpected restart of the snmptrapd daemon; unusual child processes spawned by snmptrapd (e.g., shell processes); core dump files generated in the working directory of snmptrapd.
• File System: Presence of core dump files (e.g., core, core.<pid>) in directories associated with the snmptrapd service; unexpected new files or scripts in directories writable by the service account.

Upgrade net-snmp to version 5.9.5 (stable) or 5.10.pre2 (development) immediately, as these are the only versions containing the fix (GitHub Advisory). Distribution-specific patches are available for Debian (DLA-4430-1, DSA-6098-1), Red Hat (RHSA-2026:0668, RHSA-2026:0696, RHSA-2026:0750, RHSA-2026:0810, RHSA-2026:0812, RHSA-2026:0815, RHSA-2026:0852, RHSA-2026:0853, RHSA-2026:0926), Ubuntu (USN-7944-1), Slackware (SSA-2025-359-01), Mageia (MGASA-2026-0008), Amazon Linux 2 (ALAS2-2026-3124), SUSE, and Oracle (lists.debian.org, Oracle CPU). As an interim workaround where patching is not immediately possible, restrict network access to UDP port 162 using firewall rules or network segmentation to allow only trusted SNMP management hosts to reach snmptrapd.

The vulnerability received broad coverage across security media outlets including SC World, GBHackers, CyberSecurityNews, SecurityOnline, The Hacker News (weekly recap), and The Cyber Express, with several articles highlighting the potential for remote code execution and the risk to enterprise network monitoring infrastructure (SC World). Paessler (a network monitoring vendor) published a blog post emphasizing the relevance of the vulnerability to network monitoring customers (Paessler Blog). Check Point Research included it in their December 29, 2025 threat intelligence report. Ireland's NCSC published a dedicated advisory PDF for the vulnerability. The oss-security mailing list disclosure by Alan Coopersmith on January 9, 2026 further amplified awareness in the open-source security community (oss-security).