It is possible to read the plaintext password, SSID, and other sensitive information from the remote ARRIS Touchstone cable modems using an SNMP request.

The remote SNMP daemon is responding with a large amount of data to a 'GETBULK' request with a larger than normal value for 'max-repetitions'. A remote attacker can use this SNMP server to conduct a reflected distributed denial of service attack on an arbitrary remote host.

Nessus was able to enumerate sensitive information on the remote device by sending SNMP requests using 'public' as the SNMP community string.

The remote device is running a version of Cisco Digital Media Manager prior to 5.3.  As such, it is affected by a privilege escalation vulnerability.  A remote, authenticated attacker could leverage this to execute arbitrary code on the device.

The remote host appears to be a Samsung printer, or a Dell printer manufactured by Samsung. It has a hard-coded SNMP read-write community string that allows access even when SNMP has been disabled in the printer management utility. A remote, unauthenticated attacker can exploit this to take control of the printer.

The remote host allows SNMP read-only access to either h3c-user.mib or hh3c-user.mib.  These MIBs contain information such as usernames, passwords, and user privileges.  A remote attacker with a valid read-only community string could exploit this to enumerate usernames and passwords, which could lead to administrative access to the device.

The remote SNMP server, listening on port 8161 (probably part of BMC Patrol) has a community name set to 'public'. 

An attacker may use this information to gain more knowledge about the remote host or to change the configuration of the remote system (if the default community allow such modifications).

It is possible to obtain the version and model type of the remote Airport device by sending SNMP requests to the remote host. 

An attacker may use this information to gain more knowledge about the target network.

It is possible to obtain the system information about the remote WLAN by sending SNMP requests with the OID 1.3.6.1.4.1.9.9.512.1.1.1.1.4.1 to the remote Access Point controller. 

An attacker may use this information to gain more knowledge about the target network.

SNMPv3 HMAC verification relies on the client to specify the HMAC length.  This makes it possible for remote attackers to bypass SNMP authentication via repeated attempts with a HMAC length value of 1, which causes only the first byte of the authentication hash to be checked. 

This issue affects SNMP implementations from multiple vendors.

Extend the SNMP settings data already gathered by testing for\ SNMP versions other than the highest negotiated.

By sending an SNMP 'get-next-request', it is possible to determine the protocol version of the remote SNMP agent.

The remote SNMP agent is part of ASG-Sentry, a web-based SNMP network management system.

It is possible to obtain the routing information on the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.4.21

An attacker may use this information to gain more knowledge about the network topology.

It is possible to disable the remote SNMP daemon by sending a GETBULK request with a large value for 'max-repetitions'.  A remote attacker may be able to leverage this issue to cause the daemon to consume excessive memory and CPU on the affected system while it tries unsuccessfully to process the request, thereby denying service to legitimate users.

The remote service appears to be an SNMPc Management Server instance, which is used by the SNMPc application for remote network management.

It is possible to obtain the list of installed software on the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.25.6.3.1.2

An attacker may use this information to gain more knowledge about the target host.

This script uses SNMP to obtain the account and password of the remote ADSL connection.  D-Link DSL Broadband routers uses a default community string and stores the ISP credentials in cleartext.

The remote host is running mibiisa.

There is a buffer overflow in older versions of this software, which may allow an attacker to gain a root shell on this host.

Note that Nessus did not actually check for this vulnerability so this might be a false positive.

It is possible to obtain the password of the remote HP JetDirect web server by sending SNMP requests.

An attacker may use this information to gain administrative access to the remote printer.

It is possible to obtain the default community name of the remote SNMP server.

An attacker may use this information to gain more knowledge about the remote host, or to change the configuration of the remote system (if the default community allows such modifications).

It is possible to obtain the default community names of the remote SNMP server.

An attacker can use this information to gain more knowledge about the remote host or to change the configuration of the remote system (if the default community allows such modifications).

It is possible to determine the model of the remote CISCO system by sending SNMP requests with the OID 1.3.6.1.4.1.9.1.

An attacker may use this information to gain more knowledge about the remote host.

It was possible to disable the remote SNMP daemon by sending a malformed packet advertising bogus length fields.

An attacker may use this flaw to prevent you from using SNMP to administer your network (or use other flaws to execute arbitrary code with the privileges of the SNMP daemon).

It is possible to obtain the system information about the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.1.1.

An attacker may use this information to gain more knowledge about the target host.

It is possible to obtain the remote private community strings using the View-Based Access Control MIB (VACM) of the remote Cisco router. An attacker may use this flaw to gain read/write SNMP access on this router.

Note that a value in this table does not necessarily mean that an instance with the value exists in table vacmAccessTable.  The SNMP private community string(s) returned may only allow read access.

It is possible to obtain the list of the network interfaces installed on the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.2.1.0

An attacker may use this information to gain more knowledge about the target host.

It is possible to obtain the list of running processes on the remote host by sending SNMP requests with the OID 1.3.6.1.2.1.25.4.2.1.2

An attacker may use this information to gain more knowledge about the target host.

It is possible to obtain the list of LanMan shares on the remote host 	by sending SNMP requests with the OID 1.3.6.1.4.1.77.1.2.27.1.1. 

	An attacker may use this information to gain more knowledge about the 	target host.

It is possible to obtain the list of LanMan services on the remote host by sending SNMP requests with the OID 1.3.6.1.4.1.77.1.2.3.1.1

An attacker may use this information to gain more knowledge about the target host.

It is possible to obtain the list of LanMan users on the remote host 	by sending SNMP requests with the OID 1.3.6.1.4.1.77.1.2.25.1.1

	An attacker may use this information to gain more knowledge about the 	target host.

It was possible to crash either the remote host or the firewall in between us and the remote host by sending an UDP packet of null size going to port 161 (snmp)

This flaw may allow an attacker to shut down your network.

ID	Name	Severity
78921	ARRIS Touchstone DG950A SNMP Information Disclosure (CVE-2014-4863)	Medium
76474	SNMP 'GETBULK' Reflection DDoS	Medium
74091	Multiple Vendor SNMP public Community String Information Disclosure	Medium
69948	Cisco Digital Media Manager < 5.3 Privilege Escalation	High
63136	Samsung / Dell Printer SNMP Backdoor	High
62759	HP/H3C and Huawei SNMP User Data Information Disclosure	High
51160	BMC SNMP Agent Default Community Name (public)	High
45022	SNMP Query Airport Version	Info
43100	SNMP Query WLAN SSID (Cisco)	Info
40449	Multiple Vendor HMAC Authentication SNMPv3 Authentication Bypass	Critical
40448	SNMP Supported Protocols Detection	Info
35296	SNMP Protocol Version Detection	Info
34396	ASG-Sentry SNMP Agent Detection	Info
34022	SNMP Query Routing Information Disclosure	Info
27841	SNMP GETBULK Large max-repetitions Remote DoS	High
25422	SNMPc Management Server Detection	Info
19763	SNMP Query Installed Software Disclosure	Info
11490	D-Link DSL Broadband Modem SNMP Cleartext ISP Credential Disclosure	Critical
11335	Solaris mibiisa MIB Parsing Remote Overflow	Critical
11317	HP JetDirect Device SNMP Request Cleartext Admin Credential Disclosure	High
41028	SNMP Agent Default Community Name (public)	High
10264	SNMP Agent Default Community Names	Critical
10969	SNMP Request Cisco Router Information Disclosure	Low
10858	Multiple Vendor Malformed SNMP Trap Handling DoS	Medium
10857	Multiple Vendor Malformed SNMP Message-Handling DoS	Medium
10800	SNMP Query System Information Disclosure	Info
10688	Cisco CatOS VACM read-write Community String Device Configuration Manipulation	Critical
10551	SNMP Request Network Interfaces Enumeration	Info
10550	SNMP Query Running Process List Disclosure	Info
10548	Microsoft Windows LAN Manager SNMP LanMan Shares Disclosure	Medium
10547	Microsoft Windows LAN Manager SNMP LanMan Services Disclosure	Low
10546	Microsoft Windows LAN Manager SNMP LanMan Users Disclosure	Medium
10266	SNMP Zero Length UDP Packet Remote DoS	Medium

SNMP Family for Nessus