284 Nortel Networks router telnet manager level without password Network Devices 2005/01/02 Marc Ruef marc.ruef at computec.ch http://www.computec.ch computec.ch 1.0 tcp 23 open|sleep|send Manager\n|sleep|close|pattern_exists $ 98 The NASL script is Copyright (C) 2000 Victor Kirhenshtein Nortel Networks Nortel Networks Other solutions Weak Authentication The remote Nortel Networks (former Bay Networks) router has no password for the manager account. An attacker could telnet to the router and reconfigure it to lock you out of it. This could prevent you from using your Internet connection. telnet to this router and set a password immediately. Approx. 10 minutes Yes Yes Maybe High 8 8 9 8 High Nessus can check this flaw with the plugin 10528 (Nortel Networks passwordless router (manager level)). 10528 Hacking Exposed: Network Security Secrets & Solutions, Stuart McClure, Joel Scambray and George Kurtz, February 25, 2003, 4th Edition, McGraw-Hill Osborne Media, ISBN 0072227427 http://www.computec.ch