{"id":"CVE-2026-33367","published":"2026-10-09T15:17:14.340","lastModified":"2026-10-11T17:17:04.760","description":"SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01","tags":[]},{"url":"https://www.hms-networks.com/","tags":[]},{"url":"https://www.hms-networks.com/cybersecurity","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json","tags":[]}],"hasPoc":true,"ai":{"summary":"SNMP allows administrative actions without authentication, enabling attackers to modify device settings, retrieve configuration files, and manage firmware updates without needing credentials. This creates a significant security gap where any network-accessible SNMP service can be exploited by unauthorized users.","exploitability":"Exploitation is straightforward with minimal preconditions - an attacker needs only network access to the SNMP service and knowledge of its IP address to perform administrative actions without authentication.","blast_radius":"The impact could be extensive across all networked devices running vulnerable SNMP services, potentially allowing attackers to gain full administrative control over critical infrastructure components.","remediation":"Disable SNMP service or implement mandatory authentication for all SNMP operations immediately, as no fixed version is published in the description.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["snmp","auth-bypass","network-service","ics"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:58:39.909Z"}}