Analyst readout for executives and security teams
Plain-English summary
This is an old Solaris SNMP service flaw that could let a remote attacker gain root privileges if vulnerable snmpdx is exposed. The business risk is mainly in legacy Solaris 5.6 through 8 systems that still run SNMP management services.
Executive priority
Treat as urgent only if legacy Solaris 5.6 through 8 remains in service. Remote root impact is severe, but exposure depends on whether snmpdx is present and reachable.
Technical view
CVE-2002-0796 is a format string vulnerability in the snmpdx logging component on Solaris 5.6 through 8. The CVE description states remote attackers can gain root privileges. The bundle does not provide CVSS, CWE, complete affected CPEs, or detailed patch identifiers.
Likely exposure
Exposure is most likely on legacy Solaris 5.6, 7, or 8 hosts running snmpdx, especially where SNMP-related services are reachable from untrusted networks. Modern environments without these legacy Solaris systems are unlikely to be exposed.
Exploitation context
The vulnerability has public advisory and vulnerability database references from 2002. The provided bundle does not show CISA KEV listing or current active exploitation evidence, so active exploitation should not be assumed from these sources alone.
Researcher notes
The source bundle names snmpdx logging as the vulnerable component and remote root as the impact. Affected metadata is incomplete, listing vendor and product as n/a despite the Solaris version text. No exploit details, CVSS, or definitive patch IDs are included.
Mitigation direction
- Identify any Solaris 5.6 through 8 systems in production or management networks.
- Check Sun/Solaris advisory guidance for the applicable security update or corrective action.
- Disable snmpdx where it is not operationally required.
- Restrict SNMP and snmpdx access to trusted management networks only.
- Retire or isolate unsupported Solaris systems where patching is not possible.
Validation and detection
- Confirm whether each legacy Solaris host is running snmpdx.
- Verify Solaris version and patch posture against the Sun advisory and OVAL definitions.
- Review firewall rules for SNMP or snmpdx exposure from untrusted networks.
- Check monitoring and logs for unexpected SNMP service access.
- Document compensating controls for any host that cannot be patched.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2002-0796 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- 20020604 Entercept Ricochet Security Advisory: Solaris snmpdx VulnerabilitiesCVE reference · mailing-list, x_refsource_BUGTRAQ
- solaris-snmpdx-format-string(9241)CVE reference · vdb-entry, x_refsource_XF
- oval:org.mitre.oval:def:114CVE reference · vdb-entry, signature
- 00219CVE reference · vendor-advisory, x_refsource_SUN
- oval:org.mitre.oval:def:11CVE reference · vdb-entry, signature
- 4932CVE reference · vdb-entry, x_refsource_BID
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.