Ciena Navigator Network Control Suite vulnerabilities

Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive information.

An authentication bypass vulnerability in Ciena Navigator NCS, MCP, and Blue Planet products due to improper handling of HTTP request paths and headers. An unauthenticated attacker can manipulate requests to bypass authentication and audit logging.

In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), hidden system accounts with default, predictable passwords were discovered. These accounts have very limited permissions but could be used by an attacker in combination with other weaknesses to escalate privileges on the system.