The flaw is in the SMUX module of Net‑SNMP, where the function smux_accept performs an unauthenticated blocking read on newly accepted connections without a timeout. An attacker can open a connection to the SMUX listener and send no data, causing the single‑threaded snmpd main loop to block indefinitely and suspend all SNMP processing. This results in a denial of service on the agent without the need to supply valid credentials.

The vulnerability affects Net‑SNMP, version 5.9.5.2 and earlier. All deployments of this agent that expose the SMUX listener are at risk. The issue is specific to the Net‑SNMP product and does not apply to other SNMP implementations.

With a CVSS score of 8.7 the flaw is considered high severity, and the EPSS score is not available, suggesting detailed exploit popularity data is missing. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the denial of service remotely and without authentication by simply establishing a TCP connection to the SMUX port, which is the primary attack vector. Operability of the SNMP agent is fully disrupted until the process is restarted or the connection is cleared, exposing critical monitoring infrastructure to outage.