An information disclosure vulnerability was reported in several Linksys DSL/Cable routers. A remote user can obtain SNMP traps.

This affects the following product versions: BEFN2PS4 (EtherFast Cable/DSL Router & Voice with 4-Port Switch), BEFSR81 (EtherFast Cable/DSL Router with 8-Port Switch)

It is reported that a remote user can query the router using the default SNMP community of 'public', which causes the router to set the querying IP address as the snmptrap host. As a result, the following type of SNMP data will be sent to the querying IP address resulting in the loss of sensitive data.

Although notified, there was no solution from the vendor at this time.

Matthew S. Hallacy