TMA-PRINTER-SNMPV3
Ensure SNMP is SNMPv3 only with authentication and privacy (or disabled)
Description
SNMPv1/v2c community strings (public/private by default) are sent in clear text and often allow configuration writes, including resetting the admin password on some models. SNMPv3 authPriv protects management traffic.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
In the Embedded Web Server (EWS: browse to https://<printer-ip>/ and sign in as administrator; HP: Security / Networking tabs, Xerox: Properties > Security / Connectivity, Ricoh: Device Management > Configuration, Canon: Settings/Registration > Network Settings / Security Settings) > Networking > SNMP (Xerox: Connectivity > Setup > SNMP; Ricoh: Configuration > SNMPv3): SNMPv1/v2c disabled (or read-only with a non-default community if a monitoring tool cannot do v3), SNMPv3 enabled with security level authPriv using SHA (SHA-256 if available) and AES; no default 'public'/'private' community strings; write access restricted to the management station.
How it is fixed
Fix method: Guidance or infrastructure patch
EWS: disable SNMPv1/v2c, enable SNMPv3, create a user with SHA authentication and AES privacy, update fleet management/monitoring tools to use SNMPv3 credentials.
Properties
- Operating systems
- Any
- Tags
- printersnmpnetwork-management
- Reference
- CIS Multi-Function Device Benchmark v1.0.0 - SNMP configuration (verify section number for your release)