SNMP Agent Default Community Name (public): How to Find and Fix It

The SNMP Agent Default Community Name (public) finding means a device answers SNMP requests that use the default community string “public”, which works like a password everyone knows. To fix it, disable SNMP if nothing uses it; otherwise remove public and private, set a long random read-only community, restrict UDP 161 to management stations, and move to SNMPv3 authPriv.

What the scanner is actually detecting

The check is a live protocol exchange: the scanner sends an SNMP request to UDP 161 using a well-known community name, and if the agent returns data, the finding is raised. Each tool names it differently:

Tenable’s synopsis for plugin 41028 is simply that the community name of the remote SNMP server can be guessed. The finding says nothing about which SNMP version you run; a reply proves at least read access with a string an attacker would try first.

Real-world risk

SNMPv1 and v2c have no real authentication. The community string is the only secret, and it travels in cleartext in every packet. With read access through “public”, anyone who can reach UDP 161 can typically pull:

• The system description, which usually includes the exact OS or firmware version.
• Interface lists, IP addresses, routing and ARP tables, which map your internal network.
• On many servers, running processes and installed software through the Host Resources MIB, and on Windows the LAN Manager MIB can expose local account and share names.

If a read-write community is also guessable (often “private”), the impact moves from reconnaissance to control: an attacker can change settings on the device. Reachable SNMP responders on the internet can also be abused for UDP reflection traffic.

Stated honestly: a read-only “public” community on an internal segment is an information leak, not remote code execution. It shortens an attacker’s discovery phase, and the high CVSS scores reflect the worst case where write access is also exposed. Treat any internet-facing instance as urgent.

How to confirm it on the host

From a Linux workstation with the Net-SNMP tools installed, query the agent the same way the scanner did. Test v1 and v2c, and try “private” too:

snmpwalk -v2c -c public 192.0.2.20 system
snmpwalk -v1  -c public 192.0.2.20 system
snmpwalk -v2c -c private 192.0.2.20 system

Any returned OIDs confirm the finding. A timeout means the agent did not answer that community from your address, which could also mean an ACL is blocking you rather than the string being gone. Also test a random string; if the device answers that too, it is not validating communities at all.

On the device itself:

# Cisco IOS / IOS XE
show running-config | include snmp-server

# Net-SNMP (Linux, BSD, many appliances)
sudo grep -nEi '^[[:space:]]*(rocommunity|rwcommunity|rocommunity6|rwcommunity6|com2sec)' /etc/snmp/snmpd.conf
sudo ss -ulpn | grep ':161'

# Windows (PowerShell)
Get-Service SNMP
Get-ItemProperty 'HKLM:SYSTEMCurrentControlSetServicesSNMPParametersValidCommunities'
Get-ItemProperty 'HKLM:SOFTWAREPoliciesSNMPParametersValidCommunities' -ErrorAction SilentlyContinue

On Windows, each value under ValidCommunities is a community name with a DWORD for its rights: 1 none, 2 notify, 4 read-only, 8 read/write, 16 read/create. If the Policies key exists, Group Policy is managing the list and local edits will not stick.

How to fix it

Option 1: turn SNMP off if nothing polls it

Ask the monitoring team first. If no NMS, backup tool or UPS software depends on the agent, removing it is the cleanest fix.

# Cisco IOS: disables SNMPv1, v2c and v3 on the device
no snmp-server

# Linux
sudo systemctl disable --now snmpd

# Windows 10 / 11
Remove-WindowsCapability -Online -Name "SNMP.Client~~~~0.0.1.0"

# Windows Server: find the feature name, then uninstall it
Get-WindowsFeature *SNMP*
Uninstall-WindowsFeature -Name <feature-name-from-the-list>
# or simply stop and disable the service
Stop-Service SNMP
Set-Service SNMP -StartupType Disabled

Microsoft lists the Windows SNMP feature as deprecated, which is one more reason to remove it where it is not needed.

Cisco IOS and IOS XE

Add the new community before removing the old one, so monitoring never loses access. Generate the string with something like openssl rand -hex 16; Cisco allows 1 to 32 alphanumeric characters, no spaces, and recommends avoiding the @ symbol because it delimits the context.

conf t
access-list 10 permit 192.0.2.10
access-list 10 deny any log
snmp-server community <new-community> ro 10
no snmp-server community public
no snmp-server community private
end
copy running-config startup-config

Use rw only if a tool genuinely writes to the device. NX-OS, ASA and other Cisco platforms use different syntax, so check their own command references.

Net-SNMP (snmpd.conf)

Back up the file, remove or comment out every line that grants “public” (including legacy com2sec mappings), and add a restricted read-only community. The optional SOURCE field limits which host or subnet may use it.

sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.conf.bak

# /etc/snmp/snmpd.conf
# rocommunity public ...          <- remove
rocommunity <new-community> 192.0.2.10

# Optional: listen only on the management address
# (the default is UDP 161 on all IPv4 interfaces)
agentaddress udp:192.0.2.20:161

sudo systemctl restart snmpd

Windows SNMP Service

In Services, open SNMP Service, then the Security tab. Under Accepted community names, remove “public”, click Add, choose READ ONLY and enter the new name (it is case sensitive). Select Accept SNMP packets from these hosts and add only your management stations. Microsoft notes that if you remove every community name, the service responds to none, which is a valid end state if you only keep the service for traps.

The same change in PowerShell:

$key = 'HKLM:SYSTEMCurrentControlSetServicesSNMPParametersValidCommunities'
New-ItemProperty -Path $key -Name '<new-community>' -PropertyType DWord -Value 4
Remove-ItemProperty -Path $key -Name 'public'
Restart-Service SNMP

For a fleet, use Group Policy: Computer Configuration > Administrative Templates > Network > SNMP, settings Specify communities and Specify permitted managers. When enabled, the agent accepts only the communities in the policy, and only read operations.

Move to SNMPv3 authPriv where supported

Changing the string does not fix cleartext. SNMPv3 with authPriv adds per-user authentication and encryption. The built-in Windows SNMP service only speaks v1 and v2c, so this applies to network gear and Net-SNMP hosts.

# Cisco IOS
snmp-server group MONITOR v3 priv access 10
snmp-server user monitor MONITOR v3 auth sha <auth-pass> priv aes 128 <priv-pass>

# Net-SNMP: stop snmpd, then add createUser to the persistent data file
# (the man page names /var/net-snmp/snmpd.conf; distro packages often use a path under /var/lib)
createUser monitor SHA <auth-passphrase> AES <priv-passphrase>
# and in /etc/snmp/snmpd.conf
rouser monitor priv

Passphrases must be at least 8 characters. Net-SNMP reads the createUser line on start, removes it and stores a derived key instead. Once v3 polling works, remove the v2c communities entirely.

Printers, UPS cards and embedded devices

These usually expose SNMP settings only in the web interface. Change the read community, disable the write community, set an allowed manager list if the firmware has one, and prefer SNMPv3 where offered. Be gentle with rescans here; our notes on scanning fragile OT devices and printers cover safe settings.

How to verify the fix and rescan

# From any host: should now time out
snmpwalk -v2c -c public 192.0.2.20 system
snmpwalk -v1  -c public 192.0.2.20 system

# From the monitoring station: should answer
snmpwalk -v2c -c <new-community> 192.0.2.20 system

# SNMPv3
snmpwalk -v3 -l authPriv -u monitor -a SHA -A '<auth-pass>' -x AES -X '<priv-pass>' 192.0.2.20 system

Net-SNMP warns that passphrases on the command line are insecure, so clear your shell history afterwards. Then rescan with the same scanner and policy, with UDP 161 in the scanned port range. If you added an ACL, the scanner may now simply be blocked; confirm the default string is gone from the configuration, not just unreachable from the scanner’s subnet.

What can break and how to roll back

• Monitoring goes dark. NMS graphs, device discovery, config backup tools, printer management and UPS shutdown software all poll SNMP. Update their credentials between adding the new community and removing the old one.
• Traps. Trap destinations have their own community settings (the Traps tab on Windows, snmp-server host on Cisco). On older IOS releases, configuring snmp-server host with an undefined community automatically inserts a matching snmp-server community line, which can bring “public” back.
• Group Policy overrides. On Windows, a GPO community list replaces the local one, so a local fix can be silently reverted.

To roll back, restore snmpd.conf.bak and restart snmpd, re-add the previous community on Cisco (keeping the ACL), or re-add the value on the Windows Security tab. If you must restore “public” temporarily, restrict it to the NMS address rather than reopening it to the whole network.

Common false positive reasons

True false positives are rare because the check requires a real SNMP reply. Disputes usually come from:

• A different device behind the IP. NAT, a virtual IP or a load balancer forwards UDP 161 somewhere other than the box you fixed.
• Stale results. The finding comes from a scan before the change and was never re-evaluated.
• Restricted views. The agent answers “public” with only a small subtree. Lower risk, but still a correct finding; fix it or record a risk acceptance.
• Unlisted devices. The answering host is a forgotten switch or appliance nobody owns; see finding assets your inventory never listed.

FAQ

Is the SNMP public community a critical vulnerability?

Nessus rates plugin 41028 High. Read-only exposure on an internal network is mainly an information leak; it becomes critical when a write community is guessable or the agent faces the internet.

Does changing the community string fix the finding permanently?

It clears the scanner finding, but v1 and v2c still send the string in cleartext, so anyone sniffing management traffic can recover it. SNMPv3 authPriv plus an ACL is the durable fix.

What is the difference between Nessus 41028 and 10264?

41028 tests specifically for “public”. 10264 covers other guessable default community names, so fix both at once by removing every default string.

Can I remove the public community from the Windows SNMP service without breaking traps?

Yes. Accepted community names on the Security tab control incoming requests; trap communities are configured separately on the Traps tab.

Tracking this finding across many hosts

Default SNMP communities tend to reappear across switches, printers and rebuilt servers, so fleet tracking matters more than any single fix. If you manage this at scale, SITEY, a self-hosted vulnerability management platform, imports findings from 16 scanners (Nessus results by uploading a .nessus export) and merges duplicates within each scanner. For Nessus findings such as plugin 41028 it can retest the individual finding after a change, and on Windows and Linux endpoints its agents can deploy AI-written remediation scripts after human approval, then re-test to confirm closure.

Sources

• Tenable: Nessus plugin 41028, SNMP Agent Default Community Name (public)
• Cisco IOS SNMP Command Reference: snmp-server community
• Net-SNMP: snmpd.conf manual page
• Microsoft Learn: Configure the SNMP Service
• Microsoft Learn: ADMX_Snmp Policy CSP (Group Policy settings)