Each line represents an individual vulnerability or group of vulnerabilities. For example, “CS1000 Multiple Hardcoded Passwords” is presented here in a single line but was reported to Nortel as sixteen (16) individual vulnerabilities.
A low severity issue falls into one of two categories. Firstly, there are those that are not directly exploitable and affect a single IP client, a small subset of the deployment, or are quite innocuous taken by themselves. In other words, they provide information which either involves only a small number (or single) client and that information requires considerable other information or effort to be useful to an attacker. The other category of low severity issues includes those that are best practices which are not intended to directly mitigate an exploitable risk but to increase overall security robustness and demonstrate due diligence.
A medium severity issue is typically an issue which can lead to further exploitation or provides short-lived effect on a minimal number of clients. It may not be immediately exploitable but provides sufficient information or access to move an attack closer to fruition. Alternately it may provide unauthorized access not directly related to the VoIP portion of the network.
A high severity issue can be exploited to compromise one or more nodes within the deployment but may require authentication, especially when exploiting multiple systems simultaneously. In addition, it may be possible to protect against untrusted exploitation of the issue by deploying traditional security tools.
A critical severity issue can be exploited by an untrusted individual to compromise the entire deployment under review. There are no security or protective mechanisms in place that will mediate exploitation of this vulnerability by an untrusted individual.
Research
Patch available
Workaround proposed
Attempting to address the issue
No vendor response