How to remediate – Nortel Networks Router Unpassworded Account (manager Level)

1. Introduction

The Nortel Networks Router Unpassworded Account (manager Level) vulnerability means a remote host can connect to the router without needing a password. This allows an attacker to fully control the device, potentially disrupting internet connectivity for your business. Systems affected are typically older Nortel and Bay Networks routers still in use. Impact on confidentiality is low, integrity is high, and availability is high due to potential lockout or reconfiguration.

2. Technical Explanation

The vulnerability occurs because the manager account on the router has no password set. An attacker can use Telnet to connect directly to the device without authentication. This allows them to change configurations, including network settings and access controls. The main precondition is that the router must be reachable via Telnet from a remote location. There is no specific CVE associated with this issue as it’s often due to misconfiguration rather than a software flaw.

• Root cause: Missing password configuration for the manager account.
• Exploit mechanism: An attacker uses the telnet command to connect to the router’s management interface without providing credentials, gaining immediate access. For example, `telnet ` will prompt for a username and password but allow access if none are configured.
• Scope: Affected platforms include Nortel Networks routers (formerly Bay Networks) running older firmware versions where default configurations haven’t been changed.

3. Detection and Assessment

You can confirm the vulnerability by attempting to connect to the router using Telnet without a password. A quick check is to see if the router responds to a telnet connection attempt. More thorough assessment involves trying common default usernames like ‘manager’ or leaving the username field blank.

• Quick checks: Use `telnet ` and observe whether it prompts for credentials, or grants access immediately.
• Scanning: Nessus plugin ID 10389 can identify unpassworded Telnet services on Nortel devices (example only).
• Logs and evidence: Check router logs for successful login attempts without a username or password. Log file locations vary by model, but often reside in `/var/log/`.

telnet 

4. Solution / Remediation Steps

The solution is to set a strong password for the manager account on the router immediately. Follow these steps carefully.

4.1 Preparation

• Dependencies: Access to the router via Telnet or console connection is needed. Roll back involves restoring the backed-up configuration file.
• Change window: A short change window may be needed depending on network usage. Approval from the networking team is recommended.

4.2 Implementation

1. Step 1: Connect to the router using Telnet or a console connection.
2. Step 2: Enter configuration mode (usually by typing ‘enable’ then ‘configure’).
3. Step 3: Set the manager account password using the command `password `.
4. Step 4: Confirm the password and save the configuration using the command `write memory` or similar.

4.3 Config or Code Example

Before

Router> enable
Router# configure
Router(config)# 

After

Router> enable
Router# configure
Router(config)# password 
Enter password: 
Confirm password: 
Router(config)# write memory
Building configuration...
[OK]

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue. Least privilege reduces the impact if an account is compromised. Strong password policies ensure accounts are difficult to crack. Regular configuration reviews identify and correct misconfigurations like missing passwords.

• Practice 1: Implement least privilege, limiting access to only those who need it.
• Practice 2: Enforce strong password policies with minimum length and complexity requirements.

4.5 Automation (Optional)

Automation is difficult for this specific issue due to the varied configuration interfaces of Nortel routers. However, network configuration management tools can be used to enforce password standards across devices.

# Example Ansible task - requires device-specific modules
- name: Set manager password on Nortel router
  nortel.router.config:
    commands:
      - password 
      - write memory

5. Verification / Validation

Confirm the fix by attempting to connect to the router using Telnet and verifying that a password is now required. A negative test involves trying to log in with no password.

• Post-fix check: Use `telnet ` and confirm it prompts for a username *and* password before granting access.
• Re-test: Repeat the initial Telnet connection attempt without credentials; it should now be rejected.
• Monitoring: Check router logs for failed login attempts with no username or password, which could indicate ongoing attacks (example only).

telnet 
Trying  ...
Connected to .
Username: 

6. Preventive Measures and Monitoring

Update your security baselines to include a requirement for strong passwords on all network devices, for example, using CIS controls. Implement regular configuration reviews during deployment or patching processes to catch misconfigurations early. A sensible patch cycle is important, but this issue is more about config than software.

• Baselines: Update security baselines to require a password for the manager account on all Nortel routers.
• Pipelines: Include configuration checks in CI/CD pipelines to ensure passwords are set correctly during deployment.
• Asset and patch process: Review router configurations regularly, at least quarterly, as part of your asset management program.

7. Risks, Side Effects, and Roll Back

Setting a password could potentially disrupt existing Telnet-based automation scripts if they rely on unauthenticated access. Incorrectly configured passwords may lock you out of the device. To roll back, restore the backed-up configuration file.

• Risk or side effect 1: Disruption to any automated processes using unauthenticated Telnet connections. Mitigation is to update those scripts with the new password.
• Roll back:
  1. Connect to the router via console connection.
  2. Restore the backed-up configuration file using the appropriate command (e.g., `restore config `).
  3. Reboot the router if necessary.

8. References and Resources

Links only to sources that match this exact vulnerability.

• Vendor advisory or bulletin: No specific vendor advisory exists for this general misconfiguration issue.
• NVD or CVE entry: No specific CVE entry exists for this general misconfiguration issue.
• Product or platform documentation relevant to the fix: Cisco Router Password Configuration Example (similar principles apply).