Abstract
The Simple Network Management Protocol (SNMP) remains the de facto standard for monitoring corporate networks. However, many devices lack support for its latest version, and common administrator misconfigurations expose organizations to severe security risks. This study aims to provide guidance on improving SNMP configuration security by identifying devices exposed through legacy SNMPv1 and SNMPv2c within private corporate networks. A grey-box penetration testing methodology was conducted across 78 public and private organisations in Spain, employing the scanning tools Onesixtyone and Metasploit to identify active devices utilising well-known community strings. The assessment reveals widespread vulnerabilities: more than 90% of the analysed organisations have assets exposed via well-known read-only community strings, and over 60% are vulnerable through well-known read–write community strings, resulting in a total of 2403 and 645 vulnerable devices, respectively. This exposure is highly critical in network hardware, affecting over 50% (read-only) and nearly 40% (read–write) of the organisations. Furthermore, multiple active disclosed vulnerabilities using OpenVAS and prevalent administrative flaws were identified. These findings underscore that basic deployment misconfigurations leave extensive internal assets exposed, highlighting an urgent need for structural remediation and improved administrative training within corporate environments.