CVE-2007-2333 in Contivity
Summary
by MITRE
Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 5_05.149, 5_05.3xx before 5_05.304, and 6.x before 6_05.140 includes the FIPSecryptedtest1219 and FIPSunecryptedtest1219 default accounts in the LDAP template, which might allow remote attackers to access the private network.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/30/2018
The vulnerability identified as CVE-2007-2333 affects Nortel VPN Router models including the Contivity 1000, 2000, 4000, and 5000 series, along with various 6.x versions prior to specific patch levels. This issue represents a critical authentication flaw that stems from the inclusion of hard-coded default accounts within the Lightweight Directory Access Protocol (LDAP) template configuration. The affected systems contain two specific default accounts named FIPSecryptedtest1219 and FIPSunecryptedtest1219 which are embedded in the router's configuration, creating a persistent security weakness that can be exploited by remote attackers.
The technical flaw manifests through the improper implementation of authentication mechanisms within the router's LDAP template, which follows the pattern described by CWE-798 - Use of Hard-coded Credentials. This vulnerability allows unauthorized remote access to private networks by leveraging these default credentials that remain active even after system deployment. The flaw exists because the router's configuration process does not properly enforce credential changes during initial setup, leaving these hardcoded accounts accessible to anyone who can reach the system through network exposure. The vulnerability is particularly concerning as it affects multiple generations of routers, indicating a systemic configuration issue that was not adequately addressed across the product line.
The operational impact of this vulnerability is severe as it provides attackers with a straightforward path to gain unauthorized access to corporate networks protected by these routers. Remote attackers can exploit this weakness to establish persistent network access, potentially leading to data exfiltration, lateral movement within the network, and further compromise of connected systems. The vulnerability enables privilege escalation and unauthorized network access, which aligns with ATT&CK technique T1078 - Valid Accounts, specifically focusing on the use of default credentials for unauthorized access. Organizations using affected Nortel routers face significant risk of network infiltration, particularly in environments where these devices are exposed to external networks without proper segmentation.
Mitigation strategies for this vulnerability require immediate implementation of several security controls. System administrators must first identify and disable the hardcoded default accounts through configuration updates, ensuring that all affected routers are patched to versions that remove these credentials from the LDAP template. Network segmentation should be implemented to limit exposure of these routers to external networks, while firewall rules should restrict access to management interfaces to trusted IP addresses only. The remediation process should include comprehensive credential management practices, including mandatory password changes for all administrative accounts, and regular security audits to ensure no hardcoded credentials remain in system configurations. Additionally, organizations should implement network monitoring to detect unauthorized access attempts and establish incident response procedures to address potential exploitation of this vulnerability. This vulnerability demonstrates the critical importance of proper credential management and configuration hardening practices as outlined in industry standards such as NIST SP 800-125 and ISO/IEC 27001 security controls.