Skip to content
HackIndex logo

HackIndex

SNMP Default and Weak Community Strings

3 min read May 15, 2026

SNMPv1 and SNMPv2c use community strings as the sole authentication mechanism. There is no encryption and no per-user authentication — the community string is sent in plaintext with every request. "public" and "private" are the defaults on most network devices and remain unchanged in many environments. Access via a valid community string exposes the full MIB tree.

Confirm Default Community Strings

Check for "public" and "private" directly before running any wordlist:

┌──(kali㉿kali)-[~]
└─$ snmpwalk -v2c -c public $TARGET_IP 1.3.6.1.2.1.1 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ snmpwalk -v2c -c private $TARGET_IP 1.3.6.1.2.1.1 2>/dev/null

A response rather than a timeout confirms the community string is valid. The OID 1.3.6.1.2.1.1 is sysDescr — any device running SNMP will respond to it.

┌──(kali㉿kali)-[~]
└─$ snmpwalk -v1 -c public $TARGET_IP 1.3.6.1.2.1.1.1 
SNMPv2-MIB::sysDescr.0 = STRING: Linux web01 5.15.0-91-generic #101-Ubuntu SMP x86_64

Response confirms read access. No response (or Timeout: No Response) means the string is wrong or SNMP is not listening.

Check SNMP Version

Identify which versions the target accepts. SNMPv1 and v2c are both vulnerable by design — cleartext, community-string-only auth:

┌──(kali㉿kali)-[~]
└─$ # Test v1
┌──(kali㉿kali)-[~]
└─$ snmpwalk -v1 -c public $TARGET_IP sysDescr
 
┌──(kali㉿kali)-[~]
└─$ # Test v2c
┌──(kali㉿kali)-[~]
└─$ snmpwalk -v2c -c public $TARGET_IP sysDescr
 
┌──(kali㉿kali)-[~]
└─$ # Test v3 (requires user credentials)
┌──(kali㉿kali)-[~]
└─$ snmpwalk -v3 -u admin -l noAuthNoPriv $TARGET_IP sysDescr

A device accepting v1 or v2c with a default community string is a confirmed misconfiguration regardless of what v3 support exists — any attacker who can reach port 161 can read the MIB without credentials.

Nmap Script Confirmation

Nmap's snmp-info script confirms SNMP is running and retrieves basic system info in one step:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 161 --script snmp-info $TARGET_IP 
161/udp open  snmp
| snmp-info:
|   enterprise: net-snmp
|   engineIDFormat: mac
|   engineIDData: b827eb1f2c3d
|   snmpEngineBoots: 14
|_  snmpEngineTime: 2d, 07h, 22m, 11s

Then confirm community access:

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 161 --script snmp-sysdescr --script-args snmp.community=public $TARGET_IP

Assess Impact of Read Access

Confirmed read community access exposes:

┌──(kali㉿kali)-[~]
└─$ # System info
┌──(kali㉿kali)-[~]
└─$ snmpwalk -v2c -c public $TARGET_IP 1.3.6.1.2.1.1
 
┌──(kali㉿kali)-[~]
└─$ # Running processes (may include command-line arguments with credentials)
┌──(kali㉿kali)-[~]
└─$ snmpwalk -v2c -c public $TARGET_IP 1.3.6.1.2.1.25.4.2
 
┌──(kali㉿kali)-[~]
└─$ # Network interfaces and addresses
┌──(kali㉿kali)-[~]
└─$ snmpwalk -v2c -c public $TARGET_IP 1.3.6.1.2.1.2
 
┌──(kali㉿kali)-[~]
└─$ # Installed software
┌──(kali㉿kali)-[~]
└─$ snmpwalk -v2c -c public $TARGET_IP 1.3.6.1.2.1.25.6.3

Running processes are the highest-value target — process command lines frequently include passwords passed as arguments to backup agents, database clients, and monitoring daemons. For full MIB enumeration see SNMP Broad System Enumeration.

SNMPv1 and v2c — Inherent Protocol Weakness

Even with a non-default community string, SNMPv1 and v2c are vulnerable to passive interception. Any network position that can see UDP port 161 traffic captures the community string in plaintext. A captured community string gives full read access until it is changed.

Check if the device is broadcasting or accepting SNMP from all sources:

┌──(kali㉿kali)-[~]
└─$ # Target responds to queries from any source — confirms no source IP restriction
┌──(kali㉿kali)-[~]
└─$ snmpwalk -v2c -c public $TARGET_IP sysContact

Devices should restrict SNMP access to specific management IPs via ACL. No source restriction combined with a default community string is the worst-case configuration.

References