CVE-2026-33367

critical · 9.3

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

9.3

CVSS

0.3%

EPSS (exploit prob.)

21st

EPSS percentile

2026-10-09

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-306

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01
https://www.hms-networks.com/
https://www.hms-networks.com/cybersecurity

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-33367