# SNMP Write-Enabled Community String

> Identifies SNMP community strings with write access enabled, allowing attackers to modify device configurations, routing tables, and system settings remotely.

- **URL:** https://hackindex.io/services/snmp/vulnerability-discovery/snmp-write-enabled-community-string
- **Path:** SNMP > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/snmp/vulnerability-discovery.md)
- **Published:** 2026-05-15
- **Updated:** 2026-05-15

SNMPv1 and v2c devices often configure a separate write community string alongside the read-only "public" string. "private" is the default write community on most devices. Write access allows modifying device configuration via SET operations and, on Linux systems running NET-SNMP, enables code execution through the EXTEND MIB.

## **Test for Write Access**

Use snmpset to attempt a SET operation on a safe, writable OID. `sysLocation` (1.3.6.1.2.1.1.6) is harmless to modify and is writable on most devices that allow SNMP writes:

- Test for Write Access
- Identify the Write Community String
- Check NET-SNMP on Linux Targets
- Impact Assessment
- Verify Nmap Detection

```bash
snmpset -v2c -c private $TARGET_IP sysLocation.0 s "test"
# SNMPv2-MIB::sysLocation.0 = STRING: test
#
```

Successful response confirms write access. An "Access denied" or timeout means the string is wrong or write is not permitted.

```bash
# Restore original value after confirming (if you noted it)
snmpset -v2c -c private $TARGET_IP sysLocation.0 s "Server Room"
```

## **Identify the Write Community String**

If "private" fails, brute force the write community. Many devices use the same string for both read and write: if you already have the read string, test it for write access first:

```bash
# Test read string for write access
snmpset -v2c -c $READ_COMMUNITY $TARGET_IP sysLocation.0 s "test"
```

If the read string does not have write access, scan for a separate write string:

```bash
# onesixtyone does not distinguish read/write: use snmpset per-candidate
for community in private manager write admin secret; do
    result=$(snmpset -v2c -c $community $TARGET_IP sysLocation.0 s "test" 2>&1)
    echo "$community: $result"
done
```

## **Check NET-SNMP on Linux Targets**

On Linux hosts running NET-SNMP, write access to the EXTEND MIB (1.3.6.1.4.1.8072.1.3.2) enables arbitrary command execution. First confirm NET-SNMP is running:

```bash
snmpwalk -v2c -c public $TARGET_IP sysDescr
# SNMPv2-MIB::sysDescr.0 = STRING: Linux target01 5.15.0-91-generic #101-Ubuntu SMP x86_64
#
```

Then check if the EXTEND MIB is accessible with write access:

```bash
snmpwalk -v2c -c private $TARGET_IP 1.3.6.1.4.1.8072.1.3.2
```

A response (even an empty table) confirms the MIB is accessible. Write access to this MIB allows creating EXTEND entries that execute arbitrary shell commands when the OID is read. See [SNMP Write Abuse - RCE via NET-SNMP-EXTEND-MIB](https://hackindex.io/services/snmp/exploitation/snmp-write-abuse-rce-via-net-snmp-extend-mib) for the full exploitation workflow.

## **Impact Assessment**

Write access via SNMP enables:

| Target type | Write impact |
| --- | --- |
| Linux (NET-SNMP) | RCE via EXTEND MIB: shell commands execute as SNMP daemon user |
| Network device (router/switch) | Modify routing tables, VLAN config, interface settings, SNMP trap destinations |
| Printer/IoT | Factory reset, configuration wipe, credential change |
| Windows (SNMP service) | Limited: Windows SNMP service write support is restricted by default |

For network devices, SNMP write access is often more impactful than read: routing table modification or SNMP trap redirection can cause outages or redirect traffic.

## **Verify Nmap Detection**

Nmap does not directly test write access, but the snmp-brute script discovers both read and write community strings if they differ:

```bash
nmap -sU -p 161 --script snmp-brute --script-args snmp-brute.communitiesdb=/usr/share/seclists/Discovery/SNMP/snmp.txt $TARGET_IP
# 161/udp open  snmp
# | snmp-brute:
# |   public - Valid credentials (read)
# |_  private - Valid credentials (write)
```

Nmap identifies write strings when the wordlist includes them. Confirm write access with snmpset after discovery.

## References

- [NET-SNMP snmpset](https://www.net-snmp.org/docs/man/snmpset.html) - snmpset syntax, type flags, and OID targeting
- [NET-SNMP EXTEND MIB](https://www.net-snmp.org/docs/mibs/netSnmpExtendMIB.html) - EXTEND MIB structure enabling command execution registration