Murrelektronik Devices Vulnerable to SNMP GETBULK Reflection DDoS

Multiple Murrelektronik network-enabled devices respond to SNMPv2c 'GETBULK' requests with disproportionately large response packets when the requesting party specifies a large max-repetitions value. This response amplification allows the affected devices to be misused as reflectors in distributed denial-of-service (DDoS) attacks against arbitrary third-party victims on the internet.

The primary impact of this vulnerability falls on third-party victims rather than on the device owner: an attacker can spoof the source IP address of SNMPv2c GETBULK requests sent to an affected device, causing the device to send the amplified response packets to the spoofed victim. With typical amplification factors observed for SNMP GETBULK in the range of 10x to 100x or more, even a small set of affected devices can generate a large volume of attack traffic. Secondary impact on the device owner includes wasted upstream bandwidth and increased CPU load on the affected devices during an attack, which may cause degraded device responsiveness for legitimate Profinet and management traffic (limited loss of availability). Exploitation requires only network reachability to UDP port 161 of the device and no authentication.

A firmware update that addresses the SNMP GETBULK response amplification behaviour is planned for release in early 2027 for the Murrelektronik MVK Pro and Impact67 Pro product lines. Until the fix becomes available, customers should apply the mitigations described above.

Murrelektronik GmbH thanks the following parties for their efforts:

• CERT@VDE for coordination (see https://certvde.com )
• Lena Heim from Wenglor for reporting the vulnerability to Murrelektronik GmbH