It's possible to get SNMP community string with management packets.
vulners.com/securityvulns/securityvulns:doc:15052