Executive brief
SNMP4J-Agent is an SNMP (Simple Network Management Protocol) agent library used to expose system monitoring and management capabilities. A critical vulnerability in the configuration storage component allows a remote attacker to execute arbitrary code by manipulating the storage path and triggering deserialization of untrusted data, provided the default SNMPv1/v2c public community string is enabled. This can lead to complete system compromise.
Technical details
The vulnerability stems from improper input validation and unsafe deserialization in SNMP4J-Agent's configuration management. The snmp4jCfgStoragePath SNMP parameter accepts attacker-controlled file paths with insufficient validation (CWE-73: External Control of File Name or Path). When a remote attacker with SNMPv1/v2c access uses the default public community string (mapped to unrestrictedWriteView in SampleAgent), they can set this path and trigger snmp4jCfgStorageOperation restore operations. The DefaultMOPersistenceProvider then deserializes the attacker-controlled file using ObjectInputStream (CWE-502: Deserialization of Untrusted Data), enabling remote code execution depending on classpath gadgets. The same path control also permits arbitrary file writes via store operations. The attack requires network access to the SNMP service and knowledge of (or access to) the default community string; no patch is currently available for version 3.8.3.
Affected products
- SNMP4J.org / AGENTPP SNMP4J-Agent <= 3.8.3
Timeline
- 2026-06-15: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-03-31: other: CVE service request logged