SNMP community with write access

What the audit found

At least one SNMP community on your router has write access enabled. Read access lets a monitoring system collect statistics; write access lets it — or anyone else who knows the community string — change settings on the router.

The audit reports this as critical when UDP port 161 is reachable from the internet, and as medium when the firewall limits it to the internal network. Either way, the community string is a password that grants configuration changes, and in SNMP v1 and v2c that password is sent in plain text with every request.

Why it matters

Think of a write-enabled community as a second admin password for your router, with three unfortunate properties.

It is easy to guess. If the community is public or private — the two defaults on countless devices — every scanner on the internet already has it. Even a custom string is often short and shared across an entire network.

It is easy to capture. SNMP v1/v2c has no encryption. Anyone who can see the traffic between your monitoring server and the router — on the same switch, on the same wireless network, at the ISP — can read the community string in every packet.

And it is powerful. With SNMP write access an attacker can change interface settings, alter routes, modify addresses, or shut down interfaces — enough to take the router offline or redirect traffic. On RouterOS the writable set is smaller than the full configuration, but it includes things you would not want a stranger to touch.

Virtually no monitoring setup needs write access. Zabbix, LibreNMS, PRTG and similar tools only read. Write access usually gets enabled by mistake, or by someone following a generic tutorial, and then forgotten.

What it looks like in Winbox

Open IP → SNMP and click Communities. Each row has a Write Access column; any community with it ticked is the problem. Also check the Addresses column — ::/0 means the community is usable from anywhere — and the Security column, where none means plain-text v1/v2c.

How to fix it

The fix is to untick Write Access on every community that has it, under IP → SNMP → Communities. Your monitoring keeps working, because it only ever reads.

While you are there, tidy the rest of the SNMP setup. Restrict each community's Addresses field to the single address of the monitoring server, and prefer SNMPv3: create a community with Security set to private, an authentication protocol (SHA1) with a password and an encryption protocol (AES) with a second password, so the credentials are not readable on the wire. Once the v3 community works in your monitoring tool, disable the old one.

Finally, make sure the input firewall drops UDP 161 arriving on the WAN interface, so SNMP is never reachable from the internet regardless of community settings. None of these changes affects your Winbox or SSH access, so Safe Mode is optional — though it never hurts when editing firewall rules.

Afterwards, from a host that is not the monitoring server, an SNMP write attempt against the router using the old community should be refused, while a walk from the monitoring server with the read-only or v3 community still returns data. Check that no row in the community list has Write Access ticked, then re-run the audit.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

Does anything actually need SNMP write access?

Rarely. Some network management platforms use it to push configuration to switches, but on a MikroTik you would normally do that over the API or SSH, which are authenticated properly. If you have a genuine need, restrict the community to a single address, use SNMPv3 with encryption, and keep the port off the WAN.

If I restrict the community to my monitoring server's address, is write access acceptable?

It is much better, but address restrictions can be spoofed for UDP and the community string is still visible on the wire with v1/v2c. Turning write access off removes the risk entirely and costs you nothing.

Will disabling write access break my monitoring?

No. Monitoring tools only read counters and tables. If a tool complains after the change, it was doing something unusual and is worth investigating.