source: https://www.securityfocus.com/bid/1177/info
All R-series platforms with firmware between 4.3.8 and 4.6.2 (inclusive) allow users who already have access to the router to modify SNMP tables which they should not be able to access. The router has a command-line mode that is reached by typing control-N after the user has passed the intial login test. At the "#" prompt one can then do most management of the device. This includes the setting of SNMP community strings in spite of the limitation imposed by the administrator.
The following devices are confirmed as vulnerable:
R2020 Dual Analog Router
R3100 ISDN Router
R3100-I ISDL Router
R3100-T IDSL router for Covad
R3232-I IDSL 4-IMUX router
R5100 Serial router
R5200 DDS router
R5220 DDS router w/ V.90 backup
R5300 T1 router
R5320 T1 router w/ V.90 backup
R5331 T1 router w/ ISDN backup
R7100-C SDSL router
R7120 SDSL Router w/int V.90
R7131 SDSL router w/int ISDN
R7171 SDSL 2x IMUX router
R7200-T SDSL router for Covad
R7220 SDSL router w/int.V.90
R7231 SDSL router w/int ISDN
R9100 Ethernet-to-ethernet Router
# set snmp community RO wookie
or
# set snmp community RW wookie
The exploit can only be attempted by those with existing access login to the device.
