Nortel vulnerabilities
33 vulnerabilities
Known vulnerabilities in Nortel products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 70 products.
Products
50 of 70- Contivity9 vulnerabilities
- Business Communications Manager4 vulnerabilities
- Cs10004 vulnerabilities
- Meridian Sl1003 vulnerabilities
- Multimedia Communication Server 51002 vulnerabilities
- Alteon Acedirector1 vulnerabilities
- Callpilot1 vulnerabilities
- Callpilot Server1 vulnerabilities
- Communications Server1 vulnerabilities
- Cvx 1800 Multi Service Access Switch1 vulnerabilities
- Media Communication Server 51001 vulnerabilities
- Media Communication Server 52001 vulnerabilities
- Multimedia Communications Server1 vulnerabilities
- Net Direct Client1 vulnerabilities
- Optivity Net Architect1 vulnerabilities
- Pc Client Soft Phone Sip1 vulnerabilities
- Sip Multimedia Pc Client1 vulnerabilities
- Sip Softphone1 vulnerabilities
- Ssl Vpn1 vulnerabilities
- Survivable Remote Gateway1 vulnerabilities
- Unistim Ip Phone1 vulnerabilities
- Universal Signaling Point1 vulnerabilities
- Voip Core Cs1 vulnerabilities
- 7220 Wlan Access Point0 vulnerabilities
- 7250 Wlan Access Point0 vulnerabilities
- 802.11 Wireless Ip Gateway0 vulnerabilities
- Centrex Ip Client Manager0 vulnerabilities
- Centrex Ip Element Manager0 vulnerabilities
- Communication Server 10000 vulnerabilities
- Contact Center0 vulnerabilities
- Ethernet Routing Switch 16120 vulnerabilities
- Ethernet Routing Switch 16240 vulnerabilities
- Ethernet Routing Switch 16480 vulnerabilities
- Ip Softphone 20500 vulnerabilities
- Media Processing Server0 vulnerabilities
- Meridian Mail0 vulnerabilities
- Meridian Option 11C0 vulnerabilities
- Meridian Option 51C0 vulnerabilities
- Meridian Option 61C0 vulnerabilities
- Meridian Option 81C0 vulnerabilities
- Mobile Voice Client 20500 vulnerabilities
- Nautica Marlin0 vulnerabilities
- Optical Metro 50000 vulnerabilities
- Optical Metro 51000 vulnerabilities
- Optical Metro 52000 vulnerabilities
- Optivity Telephony Manager0 vulnerabilities
- Periphonics0 vulnerabilities
- Succession Communication Server 10000 vulnerabilities
- Succession Communication Server 20000 vulnerabilities
- Symposium Agent0 vulnerabilities
CVE-2007-2333nortelcontivity
EPSS score2.57%
Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 5_05.149, 5_05.3xx before 5_05.304, and 6.x before 6_05.140 includes the FIPSecryptedtest1219 and FIPSunecryptedtest1219 default accounts in the LDAP template, which might allow remote attackers to access the private network.CVE-2007-2334nortelcontivityEPSS score1.61%
Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 5_05.149, 5_05.3xx before 5_05.304, and 6.x before 6_05.140 has two template HTML files lacking certain verification tags, which allows remote attackers to access the administration interface and change the device configuration via certain requests.CVE-2007-2886nortelcommunications_serverEPSS score1.75%
Unspecified vulnerability in the Nortel CS 1000 M media card in Enterprise VoIP-Core-CS 1000E, 1000M, and 1000S 04.50W before 20070523 in Meridian/CS 1000 allows remote attackers to cause a denial of service (card hang) via unspecified vectors.CVE-2007-1057nortelnet_direct_clientEPSS score1.11%
The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424, VPN 3050 and 3070, and SSL VPN Module 1000 extracts and executes files with insecure permissions, which allows local users to exploit a race condition to replace a world-writable file in /tmp/NetClient and cause another user to execute arbitrary code when attempting to execute this client, as demonstrated by replacing /tmp/NetClient/client.CVE-2007-5638nortelbusiness_communications_manager+1EPSS score1.47%
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines, use only 65536 different values in the 32-bit ID number field of an RUDP datagram, which makes it easier for remote attackers to guess the RUDP ID and spoof messages. NOTE: this can be leveraged for an eavesdropping attack by sending many Open Audio Stream messages.CVE-2007-5637nortelbusiness_communications_manager+1EPSS score3.13%
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines allow remote attackers to eavesdrop on the physical environment via an Open Audio Stream message that enables "surveillance mode." NOTE: issues relating to a small ID number space can be leveraged to make this attack easier.CVE-2007-5640nortelbusiness_communications_manager+1EPSS score1.82%
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), Mobile Voice Client, and other product lines, allow remote attackers to block calls and force re-registration via a resume message to the Signaling Server that has a spoofed source IP address for the phone. NOTE: the attack is more disruptive if a new spoofed resume message is sent after each re-registration.CVE-2007-5591nortelvoip-core-csEPSS score2.29%
The CS1000 signaling server in Nortel Enterprise VoIP-Core-CS 1000M Chassis/Cabinet, Enterprise VoIP-Core-CS 1000E and 1000S, Meridian-Core-Option 11C Chassis and Cabinet, and Meridian-Core-Option 51C, 61C, and 81C allows remote attackers to cause a denial of service (telephony application outage) via a flood of packets to Embedded LAN (ELAN) ports.CVE-2007-3438nortelsip_softphoneEPSS score2.46%
Buffer overflow in the SIP header parsing module in the Nortel PC Client SIP Soft Phone 4.1 3.5.208[20051015] allows remote attackers to execute arbitrary code via a malformed message, a different vulnerability than CVE-2007-3361.CVE-2007-3361nortelpc_client_soft_phone_sipEPSS score1.92%
The Nortel PC Client SIP Soft Phone 4.1 3.5.208[20051015] allows remote attackers to cause a denial of service (device crash) via a SIP message with a malformed header.CVE-2005-2579nortelcontivityEPSS score0.29%
Nortel Contivity VPN Client V05_01.030, when configuring a certificate to be used as authentication, does not properly drop system privileges, which allows local users to gain privileges by opening a program with the File Open dialog box.CVE-2005-1802nortelcontivityEPSS score1.59%
Nortel VPN Router (aka Contivity) allows remote attackers to cause a denial of service (crash) via an IPsec IKE packet with a malformed ISAKMP header.CVE-2005-0356alaxalaalaxala_networks+26EPSS score82.76%
Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old.CVE-2005-0844nortelcontivityEPSS score0.44%
Nortel VPN client 5.01 stores the cleartext password in the memory of the Extranet.exe process, which could allow local users to obtain sensitive information.CVE-2005-4197nortelssl_vpnEPSS score11.85%
tunnelform.yaws in Nortel SSL VPN 4.2.1.6 allows remote attackers to execute arbitrary commands via a link in the a parameter, which is executed with extra privileges in a cryptographically signed Java Applet.CVE-2008-2218nortelmultimedia_communications_serverEPSS score1.86%
Buffer overflow in the Multimedia PC Client in Nortel Multimedia Communication Server (MCS) before Maintenance Release 3.5.8.3 and 4.0.25.3 allows remote attackers to cause a denial of service (crash) via a flood of "extraneous" messages, as demonstrated by the Nessus "Generic flood" denial of service plugin.CVE-2008-4999nortelunistim_ip_phoneEPSS score3.83%
Nortel Networks UNIStim IP Phone 0604DAS allows remote attackers to cause a denial of service (crash) via a long ping packet ("ping of death"). NOTE: this issue could not be reproduced by a third party, who tested it on 0604DAD. In addition, the original researcher was not able to reliably reproduce the issue.CVE-2008-5872nortelmultimedia_communication_server_5100EPSS score1.92%
Multiple unspecified vulnerabilities in the UNIStim File Transfer Protocol (UFTP) processing in IP Client Manager (IPCM) in Nortel Multimedia Communication Server (MSC) 5100 3.0.13 allow remote attackers to cause a denial of service (device outage) via a UFTP message that has a negative block size or other crafted Connection Details values.CVE-2008-5871nortelmultimedia_communication_server_5100EPSS score1.61%
Nortel Multimedia Communication Server (MSC) 5100 3.0.13 does not verify credentials during call placement, which allows remote attackers to spoof and redirect VoIP calls, possibly related to the snoop command.CVE-2008-6578nortelcs1000EPSS score3.32%
Multiple unspecified vulnerabilities in Nortel Communication Server 1000 4.50.x allow remote attackers to execute arbitrary commands to gain privileges, obtain sensitive information, or cause a denial of service via unknown vectors.