UDP Dangerous Monitoring

Port 161 (SNMP)

Learn about port 161 (SNMP) - security risks, vulnerabilities, and common uses. Find devices with port 161 open.

Quick Info

Port Number

161

Protocol

UDP

Service

SNMP

IANA Name

SNMP

Service Description

Network port 161 (UDP) is the standard port for the Simple Network Management Protocol (SNMP). SNMP is an application layer protocol used to monitor and manage network devices such as routers, switches, servers, printers, and more. It enables network administrators to collect information about device performance, identify potential problems, and remotely configure devices. SNMP operates using a client-server architecture. The SNMP agent, residing on the managed device, collects data and responds to requests from the SNMP manager. The manager sends Get, GetNext, and Set requests to the agent. The agent responds with the requested data or acknowledges the Set request. SNMP uses a Management Information Base (MIB) which defines the structure and data types of the information available for management. SNMP versions have evolved over time, with SNMPv1 being the initial version, followed by SNMPv2c and SNMPv3, which introduced enhanced security features. The protocol works by encapsulating its messages within UDP datagrams, making it connectionless and relatively lightweight. The requests and responses are structured according to ASN.1 and encoded using Basic Encoding Rules (BER).

## Firewall Recommendations

Blocking port 161 (UDP) from untrusted networks is a crucial security measure. If SNMP is required, restrict access to specific trusted IP addresses or networks. For internal networks, consider using SNMPv3 with strong authentication and encryption. Regularly audit and change default community strings. Disable SNMP if it is not needed. Implement access control lists (ACLs) on network devices to limit SNMP access. Monitor SNMP traffic for suspicious activity. Ensure that SNMP agents are properly configured and patched against known vulnerabilities. Consider using a dedicated VLAN for SNMP traffic to further isolate it from other network traffic.

Security Information

SNMP, particularly versions 1 and 2c, suffers from significant security vulnerabilities. The primary issue is the use of community strings (like 'public' for read-only access and 'private' for read-write access) for authentication. These strings are often left at their default values or easily guessable, allowing unauthorized access to device information and even the ability to reconfigure devices. Attackers can use SNMP to gather detailed information about the network infrastructure, including device types, software versions, network topology, and user accounts. This information can then be used to plan further attacks. Furthermore, the lack of encryption in SNMPv1 and v2c means that the community strings and data transmitted over the network can be intercepted and analyzed. SNMPv3 addresses some of these issues with authentication and encryption, but it's not always implemented correctly or widely adopted. The ability to remotely configure devices via SNMP makes it a prime target for attackers seeking to disrupt network services or compromise systems.

Known Vulnerabilities

CVE	Name	Severity	Description
CVE-2002-0013	Net-SNMP integer overflow vulnerability	High	An integer overflow in Net-SNMP allows remote attackers to cause a denial of service (crash) via an SNMP query.
CVE-2017-6494	LibreNMS Remote Code Execution	Critical	A remote code execution vulnerability exists in LibreNMS due to insufficient sanitization of SNMP data.
CVE-2017-12165	Cisco Smart Install Denial of Service	High	A vulnerability in the Cisco Smart Install client functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (device reload) condition.
CVE-2003-0070	SNMPv1/v2c community string disclosure	Medium	The use of default or weak SNMP community strings allows unauthorized access to device information and configuration.
CVE-2016-9925	Net-SNMP DoS via malformed PDU	Low	Net-SNMP allows remote attackers to cause a denial of service (application crash) via a malformed PDU.