CVE-2008-2214

published 2008-05-14

CVE-2008-2214: Stack-based buffer overflow in the Network Manager in Castle Rock Computing SNMPc 7.1 and earlier allows remote attackers to cause a denial of service (crash)…

Priority P3 57 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Stack-based buffer overflow in the Network Manager in Castle Rock Computing SNMPc 7.1 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long community string in an SNMP TRAP packet.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
castle_rock	snmpc	<= 7.1	—

Detection & IOCs extracted from sources · hover to see the quote

port 162↗

command SNMP TRAP with community string of 'D' x 19500 (19500-byte overflow payload)↗

• → Detect SNMP TRAP packets (UDP port 162) containing abnormally long community strings (e.g., >= 19500 bytes), which indicate exploitation of the SNMPc stack-based buffer overflow. ↗
• → Monitor for SNMP TRAP packets with maxmsgsize set to 65535 combined with oversized community strings targeting UDP port 162. ↗
• → The overflow is triggered via the community string field in an SNMP TRAP packet; alert on community strings significantly exceeding normal length limits in SNMP v1/v2c traffic. ↗

• · The exploit uses a randomly assigned agent address value, meaning the source IP in the SNMP TRAP agentaddr field may not reflect the true attacker address and should not be relied upon for attribution. ↗
• · Affected versions are SNMPc 7.1 and earlier; detections should be scoped to environments running Castle Rock Computing SNMPc on the Network Manager component. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119