Murrelektronik Devices Vulnerable to SNMP GETBULK Reflection DDoS
Multiple Murrelektronik network-enabled devices respond to SNMPv2c 'GETBULK' requests with disproportionately large response packets when the requesting party specifies a large max-repetitions value. This response amplification allows the affected devices to be misused as reflectors in distributed denial-of-service (DDoS) attacks against arbitrary third-party victims on the internet.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2008-4309US | medium5.0 | — | ||
Integer overflow in the netsnmp_create_subtree_cache function in agent/snmp_agent.c in net-snmp 5.4 before 5.4.2.1, 5.3 before 5.3.2.3, and 5.2 before 5.2.5.1 allows remote attacke… | ||||
references
External citations — patches, advisories, analysis.
- VDE-2026-063: Murrelektronik Devices Vulnerable to SNMP GETBULK Reflection DDoS - HTMLself
- CERT@VDE Security Advisories for Murrelektronikexternal
- VDE-2026-063: Murrelektronik Devices Vulnerable to SNMP GETBULK Reflection DDoS - CSAFself
- Murrelektronik Product Security Incident Response (PSIRT) Teamexternal
remediations (2)
- No fix planned
For the majority of affected products no vendor fix is planned. The issue stems from the default SNMP community strings ('public', 'private') shipped with the affected firmware; these products must be secured via the network-level mitigations described in the general recommendations (restrict SNMP access, change or disable default community strings where configurable, and isolate management interfaces).
- No fix available
A firmware update that addresses the SNMP GETBULK response amplification behaviour is planned for release in early 2027 for the Murrelektronik MVK Pro and Impact67 Pro product lines. Until the fix becomes available, customers should apply the mitigations described above.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan