We are currently using SNMP4J-Agent version 3.8.3 in our product.
While reviewing security vulnerabilities applicable to our software, we identified CVE-2026-39006 as potentially affecting SNMP4J-Agent version 3.8.3.
We have reviewed the currently available releases but have not been able to identify a newer version that explicitly addresses this vulnerability.
Could you help us with details regarding any plans to fix this in the upcoming releases.
If you do not run the unmodified SampleAgent with network remote access, then this issue is not remote exploitable. If you not running the SampleAgent at all, then you are not affected as well. It is just a configuration problem of those users running the SampleAgent. It is meant as an example and has predefined credentials und insecure VACM configuration which should NEVER be used for non-local purposes!
To finally avoid such problems, I will remove the SampleAgent from the code in version 3.9.0 and put it in an external package. This might make it harder for newbies to find the right information but people seem to ignore security too much for being able to provide such samples.
BTW, the author of the CVE has not contacted me yet. Seems to something AI generated and mostly non-Sense, i.e., if you provide the credentials of your system for admin access in the Internet, every system is vulnerable. That is the essence of that CVE-2026-39006.
Just a suggestion: Generate some random values for each hard coded community/password and print them to console at startup. So the sample agent can stay in the package and it should be clear for every user that the SampleAgent is only an example.
Jochen, you are right. Had the same idea later. I will remove the community based write in the example completely and provide an option to set a unique “admin password” for all protected access. If that is not given, a random one will be generated and logged on console on startup.
SNMP4J-Agent 3.9.0 will provide several improvements to make the SampleAgent secure even when it is executed unchanged.
SNMP4J-Agent 3.9.0 has been released now.