Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 505.149, 505.3xx before 505.304, and 6.x before 605.140 has two template HTML files lacking certain verification tags, which allows remote attackers to access the administration interface and change the device configuration via certain requests.

Nortel VPN Router (aka Contivity) 1000, 2000, 4000, and 5000 before 505.149, 505.3xx before 505.304, and 6.x before 605.140 includes the FIPSecryptedtest1219 and FIPSunecryptedtest1219 default accounts in the LDAP template, which might allow remote attackers to access the private network.

Nortel VPN Router (aka Contivity) allows remote attackers to cause a denial of service (crash) via an IPsec IKE packet with a malformed ISAKMP header.