CVE-2004-2621: Nortel Contivity

Medium severity, CVSS 4.0. EPSS: 0.7% chance of exploitation in the next 30 days.

Nortel Contivity VPN Client 2.1.7, 3.00, 3.01, 4.91, and 5.01, when opening a VPN tunnel, does not check the gateway certificate until after a dialog box has been displayed to the user, which creates a race condition that allows remote attackers to perform a man-in-the-middle (MITM) attack.

Affected products

• Nortel Contivity: version 2.1.7 only; version 3.00 only; version 3.01 only; version 4.91 only; version 5.01 only

Published 2004-12-31. Last modified 2026-06-16.