lwIP SNMPv3 USM Handler Stack Buffer Overflow in snmp_parse_inbound_frame()

#!/usr/bin/env python3
"""check_cve_2026_8836.py — Detect lwIP SNMPv3 exposure for CVE-2026-8836.

Sends an SNMPv3 engine discovery probe to the target on UDP/161.
If the target responds, it is running an SNMPv3 agent and MAY be
vulnerable if the underlying stack is lwIP 2.0.1–2.2.1.

Exit codes:
  0 = VULNERABLE (SNMPv3 agent responded — verify firmware version)
  1 = PATCHED    (no SNMPv3 response — SNMP not enabled or not v3)
  2 = UNKNOWN    (network error or ambiguous result)

Usage: python3 check_cve_2026_8836.py <target_ip>
"""
import socket
import sys

# SNMPv3 engine discovery request (msgSecurityParameters empty)
# This is a minimal valid SNMPv3 GET with no auth, requesting engineID
SNMPV3_DISCOVERY = bytes.fromhex(
    '303e'          # SEQUENCE
    '020103'        # msgVersion: 3
    '3011'          # msgGlobalData SEQUENCE
      '0204deadbeef' # msgID
      '020300ffff'   # msgMaxSize: 65535
      '040104'       # msgFlags: reportable, noAuthNoPriv
      '020103'       # msgSecurityModel: USM (3)
    '0400'          # msgSecurityParameters: empty OCTET STRING
    '3020'          # SEQUENCE (scoped PDU)
      '0400'        # contextEngineID: empty
      '0400'        # contextName: empty
      'a012'        # GET-REQUEST PDU
        '020401020304'  # request-id
        '020100'        # error-status: 0
        '020100'        # error-index: 0
        '3004'          # varbind list
          '3002'        # varbind
            '0600'      # OID: empty (discovery)
)

def main():
    if len(sys.argv) != 2:
        print('Usage: python3 check_cve_2026_8836.py <target_ip>')
        sys.exit(2)

    target = sys.argv[1]
    port = 161
    timeout = 5

    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(timeout)
        sock.sendto(SNMPV3_DISCOVERY, (target, port))
        try:
            data, addr = sock.recvfrom(4096)
            if len(data) > 10 and data[0] == 0x30:
                # Check for msgVersion == 3 in response
                if b'\x02\x01\x03' in data[:10]:
                    print(f'VULNERABLE — {target}:{port} responded to SNMPv3 discovery.')
                    print('  An SNMPv3 agent is active. If this device runs lwIP 2.0.1–2.2.1,')
                    print('  it is vulnerable to CVE-2026-8836 (pre-auth stack overflow).')
                    print('  ACTION: Check firmware version against vendor advisory.')
                    sock.close()
                    sys.exit(0)
                else:
                    print(f'PATCHED — {target}:{port} responded but not SNMPv3 (likely v2c only).')
                    print('  The SNMPv3 USM code path (CVE-2026-8836) is not reachable.')
                    sock.close()
                    sys.exit(1)
            else:
                print(f'UNKNOWN — {target}:{port} sent unrecognized response ({len(data)} bytes).')
                sock.close()
                sys.exit(2)
        except socket.timeout:
            print(f'PATCHED — {target}:{port} did not respond to SNMPv3 discovery within {timeout}s.')
            print('  SNMP is not enabled or port is filtered. CVE-2026-8836 is not reachable.')
            sock.close()
            sys.exit(1)
    except Exception as e:
        print(f'UNKNOWN — network error: {e}')
        sys.exit(2)

if __name__ == '__main__':
    main()