Retry in progress
You have 1 previous attempt for this scenario. Submitting again will create a new attempt and show a comparison against your most recent response.
VLAN Leak + Cred ExposureDifficulty · easyHigh asset
An office workstation reported "weird ARP entries" — naming convention matched prod-mgmt servers. We did a quick capture from a sample office desk and saw:
- SNMPv1/v2c GETs with community="public" and "acme-mgmt" toward prod-mgmt routers
- SMBv1 broadcast browsing announcements from prod-mgmt jumphost
- ARP for 10.0.99.1 (prod-mgmt gateway) appearing on office segment
A trunk allowed-VLAN list change went into DIST-A 4 days ago for a "fix". It looks like prod-mgmt VLAN 99 was added to the office trunk by mistake.
Treat as both a segmentation violation and a credential exposure (those SNMP communities are now exposed on a less-trusted segment).
— SOC L2
Evidence
Trunk config diff + tcpdump from office desk
# DIST-A trunk config (current)
interface Po2
switchport mode trunk
switchport trunk allowed vlan 10,20,30,99 <-- vlan 99 added 4d ago
# DIST-A trunk config (4d ago, pre-change)
interface Po2
switchport mode trunk
switchport trunk allowed vlan 10,20,30 <-- vlan 99 NOT present
# tcpdump on an office workstation (sample, 60s)
09:18:04 10.0.99.5 -> 10.0.99.255 SNMP v2c community="public" (RouterOS get)
09:18:09 10.0.99.5 -> 10.0.99.255 SNMP v2c community="acme-mgmt"
09:18:15 10.0.99.7 -> 10.0.99.255 SMBv1 BROWSE Announcement: PROD-MGMT-JUMP01
09:18:23 10.0.99.5 -> 10.0.99.1 SNMP v2c community="acme-mgmt" set request
# ARP on office workstation
Internet 10.0.99.1 0 bcd1.7f00.001a ARPA Vlan10
Internet 10.0.99.5 0 001e.7d00.0099 ARPA Vlan10
Affected asset
- Name
- DIST-A Po2 + prod-mgmt SNMP credentials
- Type
- L2 trunk misconfig + cleartext credential exposure
- Owner
- Network Operations · Core Distribution
- Level
- High