Port 161 – SNMP (Simple Network Management Protocol)

Port 161 is the default UDP port for SNMP (Simple Network Management Protocol), the protocol network management systems use to poll and configure devices — routers, switches, firewalls, printers, servers, and UPS units. An SNMP agent listens on UDP 161 and answers GET queries and SET commands from a manager, while the device’s own alerts travel the opposite direction to SNMP traps on port 162. Because SNMPv1 and v2c authenticate with nothing more than a plaintext “community string” — and that string is very often the default public — an exposed port 161 is one of the richest information-disclosure targets on any network.

Why It’s Open

SNMP is the lingua franca of network monitoring. Almost every managed switch, router, firewall, printer, wireless AP, server BMC, UPS, and IoT sensor ships an SNMP agent, and monitoring stacks like PRTG, Zabbix, LibreNMS, Observium, and SolarWinds poll them all day on UDP 161. Because the protocol predates any real security model, agents are routinely left on with SNMPv1/v2c and the stock public (read) and private (read-write) community strings. Where 161 answers, its relatives are usually one scan away — SNMP traps on 162 for device-initiated alerts, and on some stacks SMUX on TCP 199 for subagent multiplexing.

Common Risks

• Default community strings. public for read and private for read-write are shipped defaults that admins forget to change. A community string is the only credential SNMPv1/v2c has, and tools guess the common ones in seconds.
• Cleartext exposure. In v1 and v2c the community string and every byte of data cross the wire unencrypted. Anyone on the path can sniff a valid string with Wireshark and replay it.
• Mass information disclosure. A single snmpwalk against a read community pulls the device inside-out: hostname and OS, every interface, the ARP and routing tables, running processes, installed software, listening TCP/UDP ports, and — on Windows agents — local user accounts.
• Write access means device takeover. A read-write community (private or otherwise) lets an attacker rewrite the configuration, reboot the box, or on Net-SNMP execute shell commands as root through the EXTEND MIB (CVE-2020-15862).
• UDP amplification / reflection DDoS. A tiny GetBulk request produces a much larger reply, so a spoofed-source query turns an open agent into a DDoS reflector — the same class of abuse as NTP on 123 and SSDP on 1900.
• Memory-corruption RCE. The SNMP parser itself has carried remote code execution bugs — Cisco IOS/IOS XE (CVE-2017-6742) and Net-SNMP (CVE-2015-5621) — so an exposed agent can be more than an information leak.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and version

nmap -sU -p 161 -sV <target>

Run the SNMP NSE scripts

nmap -sU -p 161 --script "snmp-info,snmp-sysdescr,snmp-interfaces,snmp-netstat,snmp-processes,snmp-win32-users,snmp-win32-software" <target>

Brute-force the community string

onesixtyone -c community.txt <target>
nmap -sU -p 161 --script snmp-brute <target>

Walk the MIB tree with a known community

snmpwalk -v2c -c public <target>                 # everything
snmpwalk -v2c -c public <target> 1.3.6.1.2.1.1   # system MIB only
snmp-check <target> -c public                     # formatted enumeration

Metasploit modules

msfconsole -q
use auxiliary/scanner/snmp/snmp_login
set RHOSTS <target>
run

use auxiliary/scanner/snmp/snmp_enum
set RHOSTS <target>
set COMMUNITY public
run

# Windows local accounts over SNMP
use auxiliary/scanner/snmp/snmp_enumusers
set RHOSTS <target>
run

# Pull a Cisco running-config to your TFTP server via the config-copy MIB
use auxiliary/scanner/snmp/cisco_config_tftp
set RHOSTS <target>
run

Every community string you crack and every config you pull is a finding — keep it with the run so it lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

• CVE-2017-6742 — A buffer overflow in the SNMP subsystem of Cisco IOS and IOS XE. An attacker who knows the read-only community string (v1/v2c) or holds SNMPv3 credentials sends a crafted SNMP packet to get remote code execution or force a reload. CVSS 8.8, part of the June 2017 Cisco advisory (nine CVEs, 2017-6736 through 2017-6744) and later exploited in the wild by APT28 against unpatched routers.
• CVE-2020-15862 — Net-SNMP through 5.8: SNMP write access to the EXTEND MIB lets an attacker run arbitrary commands as root. The clearest demonstration of why a writable community string is a full-host compromise, not just a config leak. CVSS 7.8, fixed in 5.8.1.
• CVE-2015-5621 — The snmp_pdu_parse function in Net-SNMP 5.7.2 and earlier fails to clean up a variable binding when PDU parsing fails, so a crafted packet can crash the agent (DoS) and potentially execute code. CVSS 7.5.
• CVE-2002-0013 — The original PROTOS/OUSPG finding: SNMPv1 request handling (GetRequest, GetNextRequest, SetRequest) in a huge range of implementations allows denial of service or privilege gain. CVSS 10.0. Its sibling CVE-2002-0012 covers the same test suite’s trap handling on the port 162 side.

Mitigation

• Disable SNMP if nothing uses it. The surest fix for an exposed agent is to turn the service off. If a device doesn’t need remote monitoring, don’t run an SNMP agent on it.
• Move to SNMPv3. v3 is the only version with real security — it adds authentication and encryption (authPriv mode). v1 and v2c have neither, and no amount of hardening fixes that.
• Change the default community strings. Never leave public/private in place. Use long, random strings, and disable read-write entirely unless a tool genuinely requires it.
• Firewall UDP 161 to management hosts only. Restrict the agent with an ACL so only your monitoring stations can reach it. Port 161 should never be exposed to the internet.
• Restrict the MIB view. Expose only the OIDs your monitoring actually reads, and block sensitive branches like the EXTEND and config-copy MIBs so a compromised community can’t be turned into code execution or config theft.
• Block spoofed sources at the edge. Anti-spoofing (BCP 38) and rate-limiting neutralize the amplification/reflection abuse that also affects NTP (123) and SSDP (1900).

Real-World Example

In 2021, the Russian state-sponsored group APT28 (Fancy Bear) went after Cisco routers that had SNMP reachable with weak or default community strings. Using CVE-2017-6742, they sent crafted SNMP packets over UDP 161 to routers running unpatched IOS, reconnoitred the devices, and deployed custom malware nicknamed “Jaguar Tooth” to harvest more device information and enable unauthenticated access. The campaign was detailed in an April 2023 joint advisory from CISA, the NSA, the FBI, and the UK’s NCSC. What makes it a textbook SNMP case is where it started: not with a zero-day, but with agents on port 161 answering to a community string they never should have accepted from the internet — the exact finding a pentest flags on day one.

FAQ

What is port 161 used for?

Port 161 is the port an SNMP agent listens on. Network management systems poll it over UDP with GET requests to read device metrics — interfaces, CPU, memory, routing tables — and SET requests to change configuration. It’s the query/polling side of SNMP; device-initiated alerts go the other way to port 162.

What is the difference between port 161 and 162?

Port 161 is where the agent listens and the manager polls it (requests and responses). Port 162 is where the manager listens for traps — asynchronous notifications the agent pushes when something happens, like an interface going down. Put simply: 161 is manager-to-agent queries, 162 is agent-to-manager alerts.

Is port 161 TCP or UDP?

SNMP uses UDP 161 by default, which is why it’s usable for amplification attacks and why replies can be lost silently. The protocol can be configured over TCP 161 on some agents, but virtually all real-world SNMP traffic is UDP.

Is port 161 dangerous?

If it’s exposed with SNMPv1/v2c and a default community string, yes. Anyone who reaches it can read the device’s full configuration without credentials, and a writable community can reconfigure or take over the host. Behind a firewall and restricted to management hosts, the risk drops sharply — but an internet-facing port 161 should be treated as an active exposure.

How do I secure or close port 161?

Disable SNMP if you don’t use it. If you do, move to SNMPv3 with authentication and encryption, replace the default community strings with long random ones, disable read-write access, and firewall UDP 161 so only your monitoring stations can reach it. Rescan afterwards to confirm the port no longer answers to public.

TL;DR

• Service: SNMP (Simple Network Management Protocol) agent — polling and management
• Default port: 161/UDP (traps on 162, SMUX on 199)
• Biggest risk: default public/private community strings and cleartext v1/v2c leaking full device config — plus RCE bugs like CVE-2017-6742
• Mitigation: disable if unused, move to SNMPv3, change default strings, disable read-write, and firewall 161 to management hosts