OpenControls Logo

STIG Viewer

STIGViewer Support

The vCenter server must enforce SNMPv3 security features where SNMP is required.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258931VCSA-80-000253SV-258931r961878_ruleCCI-001967medium
Description
SNMPv3 supports commercial-grade security, including authentication, authorization, access control, and privacy. Previous versions of the protocol contained well-known security weaknesses that were easily exploited. SNMPv3 can be configured for identification and cryptographically based authentication. SNMPv3 defines a user-based security model (USM) and a view-based access control model (VACM). SNMPv3 USM provides data integrity, data origin authentication, message replay protection, and protection against disclosure of the message payload. SNMPv3 VACM provides access control to determine whether a specific type of access (read or write) to the management information is allowed. Implement both VACM and USM for full protection. SNMPv3 must be disabled by default and enabled only if used. SNMP v3 provides security feature enhancements to SNMP, including encryption and message authentication.
STIGDate
VMware vSphere 8.0 vCenter Security Technical Implementation Guide2026-05-23

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-04Identification & Authentication for Devices
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (49) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-18(1)Authentication and Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-4(17)Domain Authentication
1.00
AC-7Unsuccessful Logon Attempts
1.00
AU-8Time Stamps
1.00

+39 more (top 10 by confidence shown)

CCI1 mapping
CCI-001967
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.AA-01
0.50
PR.AA-03
0.50
PR.AA-05
0.50

Details

Check Text (C-258931r961878_chk)

At the command prompt on the vCenter Server Appliance, run the following commands: # appliancesh # snmp.get Note: The "appliancesh" command is not needed if the default shell has not been changed for root. If "Enable" is set to "False", this is not a finding. If "Enable" is set to "True" and "Authentication" is not set to "SHA1", this is a finding. If "Enable" is set to "True" and "Privacy" is not set to "AES128", this is a finding. If any "Users" are configured with a "Sec_level" that does not equal "priv", this is a finding.

Fix Text (F-62580r934450_fix)

At the command prompt on the vCenter Server Appliance, run the following commands: # appliancesh # snmp.set --authentication SHA1 # snmp.set --privacy AES128 To change the security level of a user, run the following command: # snmp.set --users <username>/<auth_password> <priv_password>/priv