SNMP:
Vulnerability Discovery
Test SNMP community strings and write access for RCE paths
SNMP Default and Weak Community Strings
Enumerate SNMP services for default or weak community strings (public/private) using brute-force tools to gain unauthorised read/write access to network devices.
SNMP Write-Enabled Community String
Identifies SNMP community strings with write access enabled, allowing attackers to modify device configurations, routing tables, and system settings remotely.
SNMP vulnerability discovery focuses on the protocol-level weaknesses that make SNMP such a reliable attack vector. Default community strings are the primary finding: "public" for read and "private" for write access ship as defaults on countless devices and survive into production more often than they should.
SNMPv1 and v2c transmit community strings in plaintext with no encryption or meaningful authentication. Any host running these versions on an accessible interface is leaking its credentials to anyone sniffing the wire. Check whether SNMPv3 is available and, if so, whether it enforces authPriv (authentication plus encryption) or falls back to noAuthNoPriv.
Writable OIDs are the critical escalation point. Test whether the discovered community string allows SET operations on key MIB branches. Look for NET-SNMP extend configurations, exposed TFTP boot parameters on network gear, and SNMP agents bound to all interfaces instead of localhost. Each finding maps directly to exploitation techniques in the next phase.