PT-2009-2047 · Nortel · Communications Server 1000+3

Published 2009-04-01 · Updated 2017-08-17 · CVE-2008-6577

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 (CS1K) version 4.50.x

Description The issue concerns the presence of multiple unspecified hard-coded accounts and passwords in the software, which can be exploited by remote attackers to gain privileges.

Recommendations For version 4.50.x, remove or change the hard-coded accounts and passwords to prevent unauthorized access.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-6577

Affected Products

Call Server

Communications Server 1000

Nortel Mg1000S

Signaling Server

References · 8

• http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=713455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6577 · Security Note
• http://secunia.com/advisories/29747 · Note
• http://securityfocus.com/bid/28691 · Note
• http://osvdb.org/44374 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41802 · Note
• http://voipshield.com/research-details.php?id=14 · Note
• http://securitytracker.com/id?1019848 · Note