CVE-2007-2332 Weak cryptography in n/a
Remote authenticated users can recover passwords via brute force due to a fixed DES key used for encryption in Nortel VPN Routers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2007-2332?
CVE-2007-2332 is a critical vulnerability in n/a, published on 27 Apr 2007. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 6_05.140 uses a fixed DES key to encrypt passwords, which allows remote authenticated users to obtain a password via a brute force attack on a hash from the LDAP store.
Which versions are affected by CVE-2007-2332?
It affects 8 products.
Products include Nortel Vpn Router 1010, Nortel Vpn Router 1050, Nortel Vpn Router 1100, Nortel Vpn Router 1700, Nortel Vpn Router 1740, Nortel Vpn Router 1750 and 2 more.
How do I fix CVE-2007-2332?
No fix has been published for CVE-2007-2332 yet. Limit exposure of the affected software until one is available.
Is CVE-2007-2332 being exploited?
There is no known exploitation of CVE-2007-2332 in the wild and no public exploit code.
Sources
Also known as GHSA-4qc5-qj4v-hc88.