CVE-2005-4197: Nortel SSL VPN

High severity, CVSS 7.5. EPSS: 11.9% chance of exploitation in the next 30 days.

tunnelform.yaws in Nortel SSL VPN 4.2.1.6 allows remote attackers to execute arbitrary commands via a link in the a parameter, which is executed with extra privileges in a cryptographically signed Java Applet.

Affected products

• Nortel SSL VPN: up to and including 4.2.1.6; version 4.1.2.11 only; version 4.1.2.12 only

Published 2005-12-13. Last modified 2026-06-16.