Vulnerable systems:
BEFN2PS4 (EtherFast Cable/DSL Router & Voice with 4-Port Switch)
BEFSR81 (EtherFast Cable/DSL Router with 8-Port Switch) (confirmed version 2.37)
Immune systems:
BEFSR81 version v2.38.1
Querying the mentioned devices with the default community of 'public' causes them to set the address that queried as their snmptrap host, dumping traffic such as the following to that address:
It looks like a combination of debugging information as well as traffic logging; many customers never use the configuration page, let alone change the SNMP communities. To make matters worse, Linksys refuses to distribute an MIB for the device, which is not surprising considering the SNMP implementation on the device is rather broken (it goes into a continuous loop).
Further, with the correct community string you could enumerate values, determine the internal network addressing, etc, and even add forwarding rules to access services on internal hosts. When a change is made, the trick is to find the SNMP var that acts as the switch to save the new config values and recycle with the new values. Some poking and some Linksys MIBS found on the Internet id'd/confirmed the software switch as:
.1.3.6.1.4.1.3955.3.1.6.0
Integer valued ... set to '1' to save new values/recycle.
