Murrelektronik Devices Vulnerable to SNMP GETBULK Reflection DDoS

Impact
The primary impact of this vulnerability falls on third-party victims rather than on the device owner: an attacker can spoof the source IP address of SNMPv2c GETBULK requests sent to an affected device, causing the device to send the amplified response packets to the spoofed victim. With typical amplification factors observed for SNMP GETBULK in the range of 10x to 100x or more, even a small set of affected devices can generate a large volume of attack traffic. Secondary impact on the device owner includes wasted upstream bandwidth and increased CPU load on the affected devices during an attack, which may cause degraded device responsiveness for legitimate Profinet and management traffic (limited loss of availability). Exploitation requires only network reachability to UDP port 161 of the device and no authentication.

General Recommendation
* Apply network-level anti-spoofing controls (BCP 38 / RFC 2827 ingress and egress filtering) on perimeter routers and firewalls so that packets with forged source IP addresses cannot reach the affected devices and so that the devices cannot be exploited as DDoS reflectors against external victims.
* Restrict SNMP access using device, switch, or firewall ACLs so that only explicitly authorized management stations can send queries to UDP port 161 of the affected devices. This both limits the attack surface and prevents the devices from being used as reflectors by untrusted networks.
* Place the affected devices in a dedicated OT or management VLAN that is isolated from untrusted networks and from the public internet. Block UDP/161 ingress and egress at the network perimeter so that the SNMP service cannot be reached or sourced from outside the trusted segment.
* Enable network monitoring, flow analysis, or IDS/IPS rules to detect anomalous SNMP activity — in particular GETBULK requests with unusually high max-repetitions values or originating from unexpected sources. Investigate matching events as potential reflection-DDoS abuse attempts.

Remediation
A firmware update that addresses the SNMP GETBULK response amplification behaviour is planned for release in early 2027 for the Murrelektronik MVK Pro and Impact67 Pro product lines. Until the fix becomes available, customers should apply the mitigations described above.