The vulnerability exists in the NetX Duo SNMP addon's _nx_snmp_utility_object_id_get function, which improperly validates the length of an OID when BER multibyte length encoding is used. A crafted SNMP packet with an OID length larger than the actual buffer causes an out-of-bounds read into adjacent heap memory. The out-of-bounds bytes are decoded and written into the agent's internal OID string buffer, corrupting its state. This can lead to denial of service via agent thread crashes on protected memory systems or silent state corruption on bare metal embedded systems.

A remote attacker can cause an out-of-bounds read that corrupts the SNMP agent's internal state. On systems with memory protection, this can cause the SNMP agent thread to crash, resulting in denial of service. On embedded systems without memory protection, the agent's internal state may be silently corrupted, potentially affecting agent functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, consider restricting SNMP access to trusted sources to reduce exposure.