Title

Ensure SNMP is disabled or not installed on all remote access endpoints. (Cat II impact)

Discussion

There are many known vulnerabilities in the SNMP protocol and if the default community strings and passwords are not modified, an unauthorized individual could gain control of the endpoint. This could lead to a denial of service or the compromise of sensitive data. Since this protocol is blocked at the router, it should not be installed or enabled on remote systems.

Check Content

Navigate to the Services applet in the Administrative Tools folder. Check the services listing to see if SNMP is installed and enabled. If SNMP service is installed, this is a finding.

Fix Text

Ensure SNMP is not enabled.

Additional Identifiers

Rule ID: SV-20954r1_rule

Vulnerability ID: V-19141

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.