Secunia

A vulnerability has been reported in 3Com OfficeConnect 812 ADSL Router, which potentially can be exploited by malicious people to gain knowledge of sensitive information.

The vulnerability is caused due to a flaw in the handling of DHCP traffic, since the device reuses a buffer containing information about prior HTTP requests without clearing it first. This information is therefore included as data in DHCP datagrams, which can disclose various potentially sensitive information.

Successful exploitation requires that the malicious person is able to monitor the network traffic.

Firmware version 1.1.7 and 1.1.9 has been reported vulnerable. Prior versions may also be affected.

Solution
Update to firmware version 2.0.0:
Further details available in Customer Area

Provided and/or discovered by
David F. Madrid

Changelog
Further details available in Customer Area

Original Advisory
Spanish:
http://nautopia.coolfreepages.com/vulnerabilidades/3com812_dhcp_leak.htm

Deep Links
Links available in Customer Area