# SNMP Default and Weak Community Strings

> Enumerate SNMP services for default or weak community strings (public/private) using brute-force tools to gain unauthorised read/write access to network devices.

- **URL:** https://hackindex.io/services/snmp/vulnerability-discovery/snmp-default-and-weak-community-strings
- **Path:** SNMP > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/snmp/vulnerability-discovery.md)
- **Published:** 2026-05-15
- **Updated:** 2026-05-15

SNMPv1 and SNMPv2c use community strings as the sole authentication mechanism. There is no encryption and no per-user authentication: the community string is sent in plaintext with every request. "public" and "private" are the defaults on most network devices and remain unchanged in many environments. Access via a valid community string exposes the full MIB tree.

## **Confirm Default Community Strings**

Check for "public" and "private" directly before running any wordlist:

- Confirm Default Community Strings
- Check SNMP Version
- Nmap Script Confirmation
- Assess Impact of Read Access
- SNMPv1 and v2c: Inherent Protocol Weakness

```bash
snmpwalk -v2c -c public $TARGET_IP 1.3.6.1.2.1.1 2>/dev/null
snmpwalk -v2c -c private $TARGET_IP 1.3.6.1.2.1.1 2>/dev/null
```

A response rather than a timeout confirms the community string is valid. The OID `1.3.6.1.2.1.1` is `sysDescr`: any device running SNMP will respond to it.

```bash
snmpwalk -v1 -c public $TARGET_IP 1.3.6.1.2.1.1.1
# SNMPv2-MIB::sysDescr.0 = STRING: Linux web01 5.15.0-91-generic #101-Ubuntu SMP x86_64
#
```

Response confirms read access. No response (or `Timeout: No Response`) means the string is wrong or SNMP is not listening.

## **Check SNMP Version**

Identify which versions the target accepts. SNMPv1 and v2c are both vulnerable by design: cleartext, community-string-only auth:

```bash
# Test v1
snmpwalk -v1 -c public $TARGET_IP sysDescr

# Test v2c
snmpwalk -v2c -c public $TARGET_IP sysDescr

# Test v3 (requires user credentials)
snmpwalk -v3 -u admin -l noAuthNoPriv $TARGET_IP sysDescr
```

A device accepting v1 or v2c with a default community string is a confirmed misconfiguration regardless of what v3 support exists: any attacker who can reach port 161 can read the MIB without credentials.

## **Nmap Script Confirmation**

Nmap's snmp-info script confirms SNMP is running and retrieves basic system info in one step:

```bash
nmap -sU -p 161 --script snmp-info $TARGET_IP
# 161/udp open  snmp
# | snmp-info:
# |   enterprise: net-snmp
# |   engineIDFormat: mac
# |   engineIDData: b827eb1f2c3d
# |   snmpEngineBoots: 14
# |_  snmpEngineTime: 2d, 07h, 22m, 11s
```

Then confirm community access:

```bash
nmap -sU -p 161 --script snmp-sysdescr --script-args snmp.community=public $TARGET_IP
```

## **Assess Impact of Read Access**

Confirmed read community access exposes:

```bash
# System info
snmpwalk -v2c -c public $TARGET_IP 1.3.6.1.2.1.1

# Running processes (may include command-line arguments with credentials)
snmpwalk -v2c -c public $TARGET_IP 1.3.6.1.2.1.25.4.2

# Network interfaces and addresses
snmpwalk -v2c -c public $TARGET_IP 1.3.6.1.2.1.2

# Installed software
snmpwalk -v2c -c public $TARGET_IP 1.3.6.1.2.1.25.6.3
```

Running processes are the highest-value target: process command lines frequently include passwords passed as arguments to backup agents, database clients, and monitoring daemons. For full MIB enumeration see [SNMP Broad System Enumeration](https://hackindex.io/services/snmp/enumeration/snmp-broad-system-enumeration).

## **SNMPv1 and v2c: Inherent Protocol Weakness**

Even with a non-default community string, SNMPv1 and v2c are vulnerable to passive interception. Any network position that can see UDP port 161 traffic captures the community string in plaintext. A captured community string gives full read access until it is changed.

Check if the device is broadcasting or accepting SNMP from all sources:

```bash
# Target responds to queries from any source: confirms no source IP restriction
snmpwalk -v2c -c public $TARGET_IP sysContact
```

Devices should restrict SNMP access to specific management IPs via ACL. No source restriction combined with a default community string is the worst-case configuration.

## References

- [NET-SNMP snmpwalk](https://www.net-snmp.org/docs/man/snmpwalk.html) - snmpwalk syntax and OID traversal
- [SNMP MIB OID reference](https://www.oidview.com/mibs/0/RFC1213-MIB.html) - standard OID tree for RFC1213 system and interface objects