SNMP Agent Default Community Name

Tenable plugin 41028 fires when an SNMP agent answers to the default read community string public, mapping to CVE-1999-0517. There is no product-specific vulnerable version range here: any device, server, printer, UPS, switch, router, or appliance running SNMPv1/v2c and still accepting public is affected. In practice this usually means read access to MIB data such as system description, interface inventory, routing details, ARP tables, software hints, and other reconnaissance-friendly metadata over UDP/161.

The vendor's HIGH label overstates reality for most enterprise estates. The decisive friction is reachability: SNMP is commonly limited to management VLANs, source-IP ACLs, or internal monitoring zones, which means the attacker often already needs internal network access before this matters. Impact is also usually *information disclosure*, not remote code execution; public is conventionally read-only, and actual config changes usually require a separate write community like private or an additional misconfiguration.

Why this verdict

• Baseline down from vendor: Tenable tags the plugin HIGH, but its own VPR is only 5.2 / Medium, which better matches modern exploitation reality.
• Attacker position required: if UDP/161 is restricted to management VLANs or NMS collectors, this is a *post-initial-access* finding. Requiring internal network position compounds downward pressure on severity.
• Exposure population narrows fast: yes, SNMP exists on millions of internet-visible systems globally, but within a mature enterprise fleet only a minority of assets should expose it outside management zones.
• Modern controls should stop step 1: NGFW rules, infrastructure ACLs, and segmentation should block arbitrary source access to SNMP. If they do, the reachable population collapses.
• Impact is usually read-only: public normally means information disclosure, not configuration change. The scarier integrity story usually needs a separate write community like private, which this plugin does not establish.

Why not higher?

This is not unauthenticated remote code execution, and it is not even guaranteed broad unauthenticated remote access in a real estate. The attack path commonly requires management-plane reachability, and the proven outcome is typically data exposure that supports later stages rather than immediate compromise of a 10,000-host estate.

Why not lower?

It still deserves attention because validation is nearly frictionless when reachable, and the leaked data can be operationally valuable to an intruder. On internet-exposed network gear, printers, UPSes, or OT-adjacent devices, public remains a very real reconnaissance amplifier.

1. Restrict SNMP to named pollers — Apply source-IP ACLs on devices and firewalls so only approved monitoring servers can reach UDP/161. For a MEDIUM finding there is no mitigation SLA; do this as part of the 365-day remediation window, but prioritize any internet-facing or flat-network devices first because segmentation is the control that most sharply reduces exploitability.
2. Disable SNMP where it is unused — Remove the service entirely from printers, appliances, lab gear, and legacy servers that are not actively monitored. There is no noisgate mitigation deadline for MEDIUM; fold this into normal config-hardening cycles inside the remediation window.
3. Move to SNMPv3 — Where platforms support it, migrate from SNMPv1/v2c to SNMPv3 with auth/privacy so community-string guessing and cleartext polling go away. This is the durable fix, especially for core network and security infrastructure, and should be completed within the remediation window.
4. Rotate default communities — Change public to a unique read-only string only if SNMPv3 migration is not immediately possible, and verify monitoring platforms are updated in lockstep. This reduces blind scanner hits, but remember it is still weaker than SNMPv3 and should be treated as an interim configuration state.
5. Watch for broad SNMP walking — Add alerts for new SNMP source IPs, unusually wide MIB walks, and SNMP from user/workstation subnets. Detection will not fix the condition, but it is cheap compensating visibility while you clean up long-tail infrastructure.

Run this from an auditor workstation or scanner host that has network reachability to the target's UDP/161. Invoke it as ./check_snmp_public.sh 10.20.30.40; it needs snmpget from Net-SNMP and optionally nmap for a better PATCHED vs UNKNOWN decision, but no elevated privileges are required unless your host restricts raw/UDP scanning.

#!/usr/bin/env bash
# check_snmp_public.sh
# Validate whether a target answers SNMP with the default community string 'public'.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN, 3=usage/dependency error

set -u

TARGET="${1:-}"
TIMEOUT_SECS="2"
OID="1.3.6.1.2.1.1.1.0"  # sysDescr.0

if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <ip-or-hostname>"
  exit 3
fi

if ! command -v snmpget >/dev/null 2>&1; then
  echo "UNKNOWN - missing dependency: snmpget (Net-SNMP)"
  exit 3
fi

snmp_query() {
  local ver="$1"
  snmpget -v "$ver" -c public -t "$TIMEOUT_SECS" -r 0 -Oqv "$TARGET" "$OID" 2>/dev/null
}

RESP_V2C="$(snmp_query 2c || true)"
if [[ -n "$RESP_V2C" ]]; then
  echo "VULNERABLE - target responded to SNMPv2c community 'public': $RESP_V2C"
  exit 0
fi

RESP_V1="$(snmp_query 1 || true)"
if [[ -n "$RESP_V1" ]]; then
  echo "VULNERABLE - target responded to SNMPv1 community 'public': $RESP_V1"
  exit 0
fi

# If nmap is present, use it to distinguish closed/unreachable from non-public SNMP.
if command -v nmap >/dev/null 2>&1; then
  NMAP_OUT="$(nmap -Pn -sU -p 161 --host-timeout 15s --max-retries 1 "$TARGET" 2>/dev/null || true)"
  if echo "$NMAP_OUT" | grep -Eq '161/udp\s+open'; then
    echo "PATCHED - UDP/161 appears open, but community 'public' did not return data"
    exit 1
  fi
  if echo "$NMAP_OUT" | grep -Eq '161/udp\s+(closed|filtered|open\|filtered)'; then
    echo "UNKNOWN - no response to 'public' and SNMP reachability is inconclusive or blocked"
    exit 2
  fi
fi

echo "UNKNOWN - no response to community 'public'; target may be patched, SNMPv3-only, ACL-restricted, filtered, or offline"
exit 2

Sources

1. Tenable Nessus Plugin 41028
2. Tenable CVE page for CVE-1999-0517
3. NVD CVE-1999-0517
4. CISA Known Exploited Vulnerabilities Catalog
5. Shodan public port exposure summary for UDP/161
6. RFC 1157 - Simple Network Management Protocol
7. Cisco SNMPv2c documentation
8. Trail of Bits onesixtyone SNMP scanner