Check: MFD02.001
Multifunction Device and Network Printers STIG:
MFD02.001
(in versions v2 r14 through v2 r9)
Title
The default passwords and SNMP community strings of all management services have not been replaced with complex passwords. (Cat I impact)
Discussion
There are many known vulnerabilities in the SNMP protocol and if the default community strings and passwords are not modified an unauthorized individual could gain control of the MFD or printer. This could lead to a denial of service or the compromise of sensitive data. The SA will ensure the default passwords and SNMP community strings of all management services are replaced with complex passwords.
Check Content
The reviewer will, with assistance from the SA, verify the default passwords and SNMP community strings of all management services have been replaced with complex passwords.
Fix Text
Develop a plan to coordinate the modification of the default passwords and SNMP community strings of all management services replacing them with complex passwords. Obtain CM approval of the plan and execute the plan.
Additional Identifiers
Rule ID: SV-7003r2_rule
Vulnerability ID: V-6781
Group Title: MFD SNMP Community Strings
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-001989 |
The organization manages information system authenticators by changing default content of authenticators prior to information system installation. |