In one sentence: Ports 161 and 162 are the doors that network management tools use to ask routers, switches and printers how they are doing, and a weak setup lets an attacker ask the same questions or change settings.

What runs on this port

SNMP, the Simple Network Management Protocol, lets monitoring tools read status from network devices such as routers, switches, firewalls and printers, and sometimes change settings. CISA describes it as a standard framework and common language for monitoring and managing devices in a network.

The IANA registry lists SNMP on UDP port 161 and SNMP traps (alerts sent by devices) on UDP port 162. CISA notes all versions run over UDP.

There are three versions. SNMPv1 and v2 rely on “community strings”, which act like shared passwords. SNMPv3, described in RFC 3411 and RFC 3414, adds message security, access control and remote configuration.

Why attackers look for it

A device that answers SNMP reveals a map of the network: what it is, what it connects to and how it is set up. CISA says SNMP may be abused to gain unauthorised access to network devices and that a remote attacker may use SNMP-enabled devices to reach an organisation’s network infrastructure.

How it gets attacked

• Sniffed or guessed community strings. CISA explains that with SNMPv1 or v2 an adversary could sniff network traffic to find the community string, enabling man-in-the-middle or replay attacks.
• Over-wide access. If a string allows writing, an attacker may be able to change device settings. CISA recommends separating read access from write access.
• No address restrictions. Without access control lists, any computer can send SNMP requests.
• Device software flaws. CVE-2017-6736: the National Vulnerability Database (NVD) records multiple flaws in the SNMP subsystem of Cisco IOS and IOS XE that could let an authenticated remote attacker execute code or cause a reload via a crafted SNMP packet. It is scored 8.8 on CVSS v3.1 and is in CISA’s Known Exploited Vulnerabilities catalogue, added 3 March 2022.

Who it affects and how badly

• Sole trader to 10 staff: a router or printer with SNMP and a default string reachable from the internet. Worst case: your network layout is exposed.
• 10 to 50 staff: offices with managed switches and printers monitored by an MSP.
• 50 to 250 staff: manufacturers and construction firms with many devices on one flat network.
• Telecoms, councils and regulated firms: large numbers of devices mean one weak string can open a path to core infrastructure.

How to check whether yours is exposed

• Read firewall rules for inbound UDP 161 and 162 from the internet. There should be none.
• Make a list of every device that supports SNMP, with its version and who monitors it.
• Check each device’s settings for default community strings such as the vendor’s factory value.
• Ask your MSP which SNMP version their monitoring uses.
• Run the free web vulnerability scan for your web-facing systems, and ask us about wider testing for the rest.

How to secure it

1. Use SNMPv3 only, and set it to authPriv, which includes authentication and encryption (CISA).
2. Use different passwords for authentication and encryption (CISA).
3. Separate reading from configuring, and follow least privilege (CISA).
4. Use SNMP views to limit which data a user can read or write (CISA).
5. Apply extended access control lists so only the monitoring server can send SNMP requests (CISA).
6. Put SNMP on a separate management network (CISA).
7. Keep device software updated (CISA).
8. Replace devices that cannot support SNMPv3 (CISA).

Related terms

• port 23 telnet
• port 22 ssh
• nmap
• vulnerability scanning
• patch management
• brute force attack
• Port 111 (RPCbind)

Frequently asked questions

What ports does SNMP use?
UDP port 161 for requests and UDP port 162 for traps, according to the IANA registry.

Which SNMP version is safest?
CISA says SNMPv3 should be the only version used, because it can authenticate and encrypt payloads.

What is a community string?
In SNMPv1 and v2 it works like a shared password. CISA notes it can be sniffed from network traffic.

Sources

• CISA alert TA17-156A, Reducing the Risk of SNMP Abuse: https://www.cisa.gov/news-events/alerts/2017/06/05/reducing-risk-snmp-abuse
• RFC 3411, Architecture for SNMP Management Frameworks: https://www.rfc-editor.org/rfc/rfc3411.txt
• RFC 3414, User-based Security Model for SNMPv3: https://www.rfc-editor.org/rfc/rfc3414.txt
• NVD record for CVE-2017-6736 (Cisco IOS SNMP): https://nvd.nist.gov/vuln/detail/CVE-2017-6736
• IANA service name and port number registry: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.