Is port 161 (SNMP) exposed to the internet with a default community string?

Why SNMP still leans on a shared “community string”

IANA registers port 161 for SNMP, the Simple Network Management Protocol used across routers, switches, UPS units, printers and countless other network-attached devices to report status and accept configuration changes remotely. SNMPv1 and v2c, still the most widely deployed versions, authenticate with a community string rather than a username and password — a design that made sense when network management traffic was assumed to never leave a trusted internal segment. In practice, an enormous share of deployed devices still ship with, or get configured with, the default read string “public” and the default write string “private,” and on v1/v2c that string travels in plaintext with no encryption at all.

A documented pattern of nation-state and criminal abuse

This isn’t hypothetical. A joint advisory from CISA, the NSA, the FBI and the UK’s NCSC detailed how the Russian state-linked group APT28 abused weak and default SNMP community strings, including “public,” to gain access to Cisco routers — including devices belonging to European and U.S. government institutions and roughly 250 Ukrainian targets — and used follow-on SNMP commands to enumerate router interfaces as part of broader reconnaissance. A more recent CISA advisory on router hygiene describes Russian FSB-linked actors systematically scanning internet IP ranges specifically for devices running SNMP agents that still accept common or default community strings — the same exposure pattern, used as a routine reconnaissance technique rather than a one-off incident.

What an exposed, default-credentialed SNMP agent gives away

A reachable port 161 with the default read string active typically lets anyone pull the device’s full configuration, interface list, routing information, installed software versions and other operational details with no credential of their own. If the default write string is also active, that same unauthenticated access can be used to change configuration — the exact escalation path documented in the advisories above.

How to check your own exposure

AdminKit’s planned open ports check is designed to test whether port 161 and other commonly-exposed device ports on your own public IP respond from outside your network. Since a device can have SNMPv3 support available but still be running v1/v2c for backward compatibility, confirming what’s actually enabled and reachable is more reliable than trusting a spec sheet.

How to fix it

• Change any default community string immediately — “public” and “private” should never remain in production on an internet-reachable device.
• Disable SNMPv1 and v2c in favor of SNMPv3, which adds real per-user authentication and, optionally, payload encryption, closing the plaintext-shared-secret gap the advisories above describe.
• Restrict port 161 to a management VLAN or specific trusted management IPs with a firewall rule, rather than leaving it reachable from any network the device happens to sit on.
• Disable SNMP entirely on devices that don’t actually need remote monitoring.

Defensive use only

Every check this page links to is for assets you own or are explicitly authorized to test. Never scan, probe, or attempt to connect to a network or device you don’t control — AdminKit’s active checks only ever run against the IP making the request or an asset you’ve verified ownership of. See our Disclaimer and Acceptable Use Policy for the full terms.