NacTrack
FRGet the demo
Security

How to find devices using default or version 1 and 2c SNMP communities

An SNMP community string is a password sent in clear text, and versions 1 and 2c have no other protection. Communities named public and private are worse still, because they are the first two anyone tries. This usually survives not through carelessness but through inheritance: a monitoring system needed read access years ago, the community was set fleet-wide, and nothing since has had a reason to revisit it.

All the questions
The same procedure as a recording, subtitled in English and French.
Before you start

What you need

  • Module required: compliance.
  • Permission required: view_audit.
  • All benchmarked platforms; the wording of the check differs by vendor

1. Open a device and read its SNMP checks

app.nactrack.com/compliance/device/12126
Open a device and read its SNMP checks
This spine switch fails two checks, and both are about SNMP. They are deliberately separate questions: one asks whether a default community name is in use, the other whether version 1 or 2c is enabled at all.

2. Filter to the failing checks

app.nactrack.com/compliance/report
Filter to the failing checks
Each column has its own filter. Typing FAIL under Status reduces the table to what is actually wrong, which matters here because most of this device's checks pass and they would otherwise fill several pages before you reached the two that do not.

3. Separate the two findings

app.nactrack.com/compliance/report
Separate the two findings
The distinction matters when you come to fix it. Renaming a community answers the first check and leaves the second failing, because the traffic is still unauthenticated and unencrypted. Only moving to version 3 clears both.
The limits

What this view does not tell you

  • A device with no SNMP configured at all passes both checks. Passing therefore means "not exposed this way", not "monitored securely" - the benchmark cannot tell an intentionally hardened device from one nobody ever set up.
  • Community strings are credentials. NacTrack reports that a weak one exists and does not print its value in the evidence, so the report can be shared without leaking what it found.

Try the same thing on your own estate

Request accessAll the questionsEvery guide as a PDF (25 MB)