How to remediate – SNMP Agent Default Community Name (public)

1. Introduction

The SNMP Agent Default Community Name (public) vulnerability means the standard community name used for Simple Network Management Protocol is still set to ‘public’. This allows anyone on the network to query information from, and potentially change settings on, affected devices. Businesses are at risk of data disclosure or unauthorised modification of network equipment. Systems running SNMP are usually affected, including routers, switches, servers, and printers. Impact is likely to be high on confidentiality, integrity, and availability if exploited.

2. Technical Explanation

The vulnerability occurs because the default community string ‘public’ remains in use for SNMPv1 or SNMPv2c. Attackers can send SNMP queries using this known community name to gather system information or alter device configurations, depending on permissions allowed by that community string. Exploitation requires network access to port 161/UDP of affected devices. CVE-1999-0517 describes this issue.

• Root cause: Use of the default ‘public’ community name with read and/or write access.
• Exploit mechanism: An attacker sends an SNMP query to port 161 using the ‘public’ community string. For example, a simple query could retrieve system uptime or network interface information. If write access is enabled, configuration changes are also possible.
• Scope: Routers, switches, servers and printers running SNMPv1 or SNMPv2c with default settings are affected.

3. Detection and Assessment

Confirming a vulnerable system involves checking the current SNMP community string. A quick check is to use `snmpwalk` with the ‘public’ community name. Thorough assessment requires reviewing device configurations.

• Quick checks: Run snmpwalk -v1 -c public . If information is returned, the default community string is active.
• Scanning: Nessus plugin ID 34859 can detect this vulnerability. OpenVAS also has relevant scans. These are examples only.
• Logs and evidence: Check device logs for SNMP activity originating from unexpected sources or using the ‘public’ community name. Log locations vary by vendor.

snmpwalk -v1 -c public 192.168.1.100

4. Solution / Remediation Steps

The best solution is to disable SNMP if it’s not needed. If SNMP is required, change the default community string and restrict access.

4.1 Preparation

• Ensure you have console or out-of-band management access in case of configuration errors. Roll back by restoring the backup configuration.
• A change window may be needed, depending on network impact and business requirements. Approval from a senior IT administrator is recommended.

4.2 Implementation

1. Step 1: If SNMP isn’t used, disable the service. On Linux systems, use systemctl stop snmpd.
2. Step 2: If SNMP is required, change the default community string to a strong, unique value.
3. Step 3: Restrict access to only trusted IP addresses or networks using Access Control Lists (ACLs).

4.3 Config or Code Example

Before

community public default RW

After

community mysecretcommunity RO 192.168.1.0/24

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue. Least privilege limits the impact of exploitation, while safe defaults reduce initial exposure. Regular patch cadence ensures known vulnerabilities are addressed.

• Practice 1: Implement least privilege by restricting access to SNMP only to necessary users and devices.
• Practice 2: Use strong, unique community strings instead of default values.

4.5 Automation (Optional)

Ansible can be used to change the SNMP community string on multiple devices. Be careful when modifying configurations remotely.

---
- hosts: all
  tasks:
    - name: Change SNMP community string
      ansible.builtin.lineinfile:
        path: /etc/snmp/snmpd.conf
        regexp: '^community public'
        line: 'community mysecretcommunity RO 192.168.1.0/24'
      notify: restart snmpd
  handlers:
    - name: restart snmpd
      ansible.builtin.service:
        name: snmpd
        state: restarted

5. Verification / Validation

Confirm the fix by checking that the default community string no longer responds to queries. Re-run `snmpwalk` with ‘public’ and verify no information is returned. Test basic SNMP functionality.

• Post-fix check: Run snmpwalk -v1 -c public . No output should be displayed.
• Re-test: Re-run the initial `snmpwalk` command to confirm ‘public’ no longer works.
• Smoke test: Verify that authorised users can still retrieve system information using the new community string.
• Monitoring: Monitor device logs for SNMP activity from unexpected sources, looking for failed authentication attempts.

snmpwalk -v1 -c public 192.168.1.100

6. Preventive Measures and Monitoring

Regular security baselines should include SNMP configuration checks. CI/CD pipelines can automate these checks, preventing insecure configurations from being deployed. A sensible patch or config review cycle is recommended.

• Baselines: Update your security baseline to require strong community strings and restricted access for SNMP.
• Pipelines: Add a check in your deployment pipeline to ensure the SNMP configuration meets security standards.
• Asset and patch process: Review SNMP configurations during regular asset audits or vulnerability scans.

7. Risks, Side Effects, and Roll Back

Changing the community string could disrupt existing monitoring systems if not updated with the new value. Incorrect configuration can prevent legitimate access to SNMP data. Roll back by restoring the backed-up device configuration.

• Risk or side effect 1: Disruption of network monitoring tools if the community string is changed without updating them.
• Risk or side effect 2: Loss of SNMP access if the configuration is incorrect.
• Roll back: Restore the backed-up device configuration to revert to the previous state.

8. References and Resources

Links only to sources that match this exact vulnerability. Use official advisories and trusted documentation.

• Vendor advisory or bulletin: SecurityFocus BID 2112
• NVD or CVE entry: CVE-1999-0517
• Product or platform documentation relevant to the fix: Consult your device vendor’s documentation for specific SNMP configuration instructions.