Malanta Uncovers Design Tradeoff in SNMPv3 That Hands Attackers a Pre-Login Roadmap

The behavior is standards-compliant and confirmed as intentional by the IETF, yet it lets an unauthenticated attacker fingerprint devices and enumerate valid usernames before login — shrinking a brute-force problem of billions of combinations to a focused password guess. Validated across roughly 470,000 internet-exposed devices, the findings land days after a 19-agency joint advisory warned of active Russian FSB exploitation of SNMP.

TEL AVIV, Israel, July 29, 2026 /PRNewswire/ -- Malanta, the pre-attack prevention company, today published research showing that SNMPv3 — the protocol widely regarded as the secure standard for managing routers, switches, and firewalls — exposes pre-authentication signals that let an unauthenticated remote actor identify a device's vendor, confirm valid usernames, and narrow its likely encryption settings before testing a single credential. Validated across approximately 470,000 internet-exposed endpoints, the findings show how these standards-compliant behaviors can collapse a multi-dimensional brute-force problem into a focused password-guessing exercise.

The research arrives days after Joint Cybersecurity Advisory AA26-194A (July 13, 2026), issued by 19 agencies across 13 countries — including the U.S. NSA, CISA, FBI, and DC3 — warning that Russian FSB Center 16 actors are actively exploiting weak SNMP configurations to compromise critical-infrastructure routers worldwide. That advisory's central recommendation is to upgrade to SNMPv3. Malanta's research examines what remains exposed after that upgrade.

"SNMPv3 was the industry's answer to insecure network management, and upgrading to it — as the CISA advisory urges — is necessary," said Kobi Ben-Naim, Co-Founder and CEO of Malanta. "But that answer is incomplete. The protocol does exactly what it was designed to do, and that design hands attackers a roadmap: even properly upgraded deployments, when exposed, leak enough through pre-authentication responses to help an attacker narrow their way in before a single credential is tested. The threat doesn't end with the upgrade."

SNMPv3 introduced authentication and encryption to replace the cleartext community strings of earlier versions. But its pre-authentication exchanges — engine discovery and User-based Security Model (USM) Report messages — return distinguishable responses that reveal structured information before authentication succeeds. Malanta formalized how three of these signals chain together: the engineID commonly reveals the device vendor and family; the vendor in turn narrows the likely authentication and encryption settings; and differential Report responses indicate whether a username exists versus whether a credential is simply wrong — functioning as a pre-authentication oracle.

Malanta responsibly disclosed the findings to the Internet Engineering Task Force (IETF), which confirmed the behavior is standards-compliant and intentional — a design decision from an era when management protocols were assumed to live on trusted networks. It is a design tradeoff, not a vendor bug or a CVE.

Key findings from Malanta's research include:

• Scale: approximately 470,000 internet-exposed SNMP endpoints were sampled; about 84.5% negotiated SNMPv3.
• Vendor exposure: 99.4% of devices leaked vendor or family identity through pre-authentication engineID metadata.
• Concentration: Cisco (302,601 devices) and open-source stacks (105,241) together made up roughly 86.8% of the sample.
• Effect: when management interfaces are exposed and credentials are weak or reused, the effective authentication search space can shrink by orders of magnitude.

The pre-authentication behavior has existed since the early 2000s. What has changed is the attacker's toolkit: AI-optimized credential guessing that prioritizes statistically likely passwords for a given device family, and commodity cloud compute that has driven the cost of large-scale password attempts to a fraction of what it was five years ago. Together they convert a narrowed search space into a fast, automated operation — turning a tradeoff that was manageable for two decades into a materially higher risk today.

Malanta recommends organizations take the management plane off the public internet, segment and restrict SNMP access with strict ACLs, run SNMPv3 over an authenticated transport (TLS/DTLS) where possible, enforce authPriv with modern HMAC-SHA-2 authentication and AES encryption, and monitor USM statistics counters (unknown-username, wrong-digest, and time-window errors) as early reconnaissance indicators rather than routine diagnostics.

For the full technical report, please click here.

About Malanta

Malanta is a pre-attack prevention company founded in 2024. The Malanta platform identifies adversary infrastructure-preparation activity, surfacing Indicators of Pre-Attack (IoPAs) that give defenders visibility into the Resource Development phase (MITRE ATT&CK TA0042) before attacks execute. Malanta holds one granted patent on its core technology, with two additional patents pending, and has raised $10M in funding. Learn more at malanta.ai.

Media Contact

Brandon Weinstock

Allison Lane, Inc

[email protected]

SOURCE Malanta