Is CVE-2022-24807 being actively exploited?

CVE-2022-24807 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2022-24807?

CVE-2022-24807 has a CVSS 3.1 base score of 6.5 (MEDIUM).

CVE-2022-24807

MEDIUM · CVSS 6.5EPSS 1.0%EU EUVD

net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` can cause an out-of-bounds memory access. A user with read-write credentials can exploit the issue. Version 5.9.2 contains a patch. Users should use strong SNMPv3 credentials and avoid sharing the credentials. Those who must use SNMPv1 or SNMPv2c should use a complex community string and enhance the protection by restricting access to a given IP address range.

Key facts

CVSS score: 6.5 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness (CWE): CWE-120
EPSS score: 1.0% (62th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2022-29607)
Published: April 16, 2024
NVD last modified: June 17, 2026
Status: Analyzed

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2022-29607 in the EU Vulnerability Database. Last updated in EUVD on August 3, 2024.

View on the EU Vulnerability Database

Affected products

debian / debian linux
debian / debian linux
fedoraproject / fedora
net-snmp / net-snmp
redhat / enterprise linux
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux for arm 64
redhat / enterprise linux for arm 64
redhat / enterprise linux for arm 64
redhat / enterprise linux for arm 64 eus
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for power little endian
redhat / enterprise linux for power little endian eus
redhat / enterprise linux for power little endian eus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server for power little endian update services for sap solutions
redhat / enterprise linux server update services for sap solutions
redhat / enterprise linux update services for sap solutions

Certified products that may be affected

9 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5445 - active
Red Hat Enterprise Linux 9 libgcrypt - Red Hat, Inc. - FIPS 140 5366 - active
Red Hat Enterprise Linux 9 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5034 - active
Red Hat Enterprise Linux 9 NSS Cryptographic Module - Red Hat, Inc - FIPS 140 5022 - active
Red Hat Enterprise Linux 9.4 - Red Hat, Inc. - Common Criteria CCEVS-VR-VID-11526-2025 - active

See all 9 in the Security Certifications Explorer.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2103225(Third Party Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=2105239(Third Party Advisory)
https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937(Patch)
https://github.com/net-snmp/net-snmp/commit/ce66eb97c17aa9a48bc079be7b65895266fa6775(Patch)
https://lists.debian.org/debian-lts-announce/2022/08/msg00020.html(Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FX75KKGMO5XMV6JMQZF6KOG3JPFNQBY7/(Product, Third Party Advisory)
https://security.gentoo.org/glsa/202210-29(Third Party Advisory)
https://www.debian.org/security/2022/dsa-5209(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain