SNMP4J-Agent 3.9.0 Release (Fixes CVE-2026-39006)

Announcements
1

SNMP4J-Agent v3.9.0 has been released 2026-06-22T22:00:00Z to improve security of sample code (i.e., SampleAgent) and default usage of the AgentConfigManager.
In addition, a security bug in Snmp4jConfigMib.snmp4jCfgStoragePath reported as CVE-2026-39006 which is exploitable with write access to that OID (1.3.6.1.4.1.4976.10.1.1.2.1.2.1.1.2) has been fixed too.
New features implementing additional security levels, like an audit log should further facilitate building secure agents.

CHANGES

  • SECURITY CVE-2026-39006: Although the CVE-2026-39006 describes a configuration and setup issue when using the SampleAgent with default credentials and remote network access, the snmp4jCfgStoragePathValidator now does not allow to modify the configuration file (and thus create new configuration files) if the Snmp4jConfigMib.snmp4jCfgStoragePath is not set. Setting it to “.” (default) will only allow to store configuration files in the current working directory.
  • SECURITY: CommandProcessor.setVacm(..) and CommandProcessor.setCoexistenceProvider(..) not reject setting null values and replacing an already set value. This measure is for security reasons to avoid accidentally setting a null value or replacing an already set value.
    If any of these values (VACM or CoexistenceProvider) is set to null, any request to the agent using this CommandProcessor will be rejected.
  • SECURITY: DefaultMOInput now installs a strict java.io.ObjectInputFilter (AgentStateDeserializationFilter) on the ObjectInputStream that is used to restore persistent agent state. Only the classes that are actually written by DefaultMOOutput (the agent IO model and the SNMP4J SMI Variable types) plus the required JDK types are allowed to be deserialized; all other classes as well as overly deep or large object graphs are rejected. New DefaultMOInput(ObjectInputStream, Collection<Class<?>>) and AgentStateDeserializationFilter constructors allow registering additional classes for custom Variable/Context subclasses.
  • SECURITY: Hardened the SampleAgentConfig.properties VACM configuration: SNMPv1 and SNMPv2c access via the “public” community is now read-only and limited to the “system” subtree (1.3.6.1.2.1.1), i.e. it cannot read other objects and cannot SET any object. The “viewer” role (USM authNoPriv user “SHA”) is limited to read-only access of selected SNMP*-MIB subtrees (1.3.6.1.6.3.18, .10, .13, .14, .12 and 1.3.6.1.2.1.74).
  • Added: PropertyMOInput now supports random OctetString values: “{r[:length]}name” generates a printable and “{R[:length]}name” a full 8-bit random OctetString. Generated random values are named and reused for later references with the same name. Named values can be predefined before deserialization through PropertyMOInput.setRandomValue(name, value) (with getRandomValue/getRandomValues accessors), e.g. to inject externally provided secrets into the configuration.
  • Added: The SampleAgent accepts the optional “-viewer <passkey>” and “-admin <passkey>” command line options and injects them as the named “viewer” and “admin” secrets into the PropertyMOInput configuration. If a pass key is not provided, a random one is generated and logged.
  • Added: New agent audit framework in the org.snmp4j.agent.audit package. The AgentAuditPolicy interface (with the DefaultAgentAuditPolicy implementation driven by an AgentPolicyProfile) audits managed object access (MOServerLookupListener), network transport access (SNMP4J TransportAuditListener) and file system access (new FileAuditListener/FileAuditEvent). The configurable AgentAuditLevel (OFF, LOG, WARN, RESTRICT) controls whether audited operations are only logged, logged as warnings on policy violations, or additionally denied where enforcement is possible (transport and file access; managed object access remains enforced by VACM).
    The audit policy is wired into AgentConfigManager (new constructor and get/setAuditPolicy accessors), the persistence providers, and the new AgentEngineBootsCounterFile, and the SampleAgent demonstrates auditing of its state configuration.
  • Added: AgentConfigManager.getMessageDispatcher() accessor.
  • Fixed: Snmp4jConfigMib now rejects duplicate snmp4jCfgStoragePath usage so that configuration files must be unique.
  • Fixed: snmp4jCfgStorageOperation validation on row creation could fail due to a race condition based on a shared value reference when the value was provided directly together with an operation.
  • Improved: MOServerLookupEvent.toString() output.
  • Updated: Implemented the new WorkerTask.shutdown() and WorkerTask.join(long) methods (required by SNMP4J v3.12.0) for the CommandProcessor command tasks and the NotificationTask.
  • Updated: snmp4j dependency to v3.12.1 and maven-jar-plugin to v3.5.0.