Authentication Bypass in Navigator and Blue Planet Products
An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Navigator NCS
Vendor
CIENA
Product
Navigator NCS
Platforms
Unknown
Default status
unaffected
Navigator NCS · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
8.1
affected
Unavailable
Unavailable
Unavailable
None listed
MCP
Vendor
CIENA
Product
MCP
Platforms
Unknown
Default status
unaffected
MCP · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
<= 8.0
affected
Unavailable
Unavailable
Unavailable
None listed
Planner Plus OnPrem
Vendor
CIENA
Product
Planner Plus OnPrem
Platforms
Unknown
Default status
unaffected
Planner Plus OnPrem · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
<= 4.1
affected
Unavailable
Unavailable
Unavailable
None listed
Inventory
Vendor
Blue Planet
Product
Inventory
Platforms
Unknown
Default status
unaffected
Inventory · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
<=24.04.001
affected
Unavailable
Unavailable
Unavailable
None listed
<=23.12.401
affected
Unavailable
Unavailable
Unavailable
None listed
<=23.08.302
affected
Unavailable
Unavailable
Unavailable
None listed
<=23.04.701
affected
Unavailable
Unavailable
Unavailable
None listed
Orchestration
Vendor
Blue Planet
Product
Orchestration
Platforms
Unknown
Default status
unaffected
Orchestration · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
<=24.04.2
affected
Unavailable
Unavailable
Unavailable
None listed
<=23.12.3
affected
Unavailable
Unavailable
Unavailable
None listed
<=23.08.4
affected
Unavailable
Unavailable
Unavailable
None listed
<=23.04.2
affected
Unavailable
Unavailable
Unavailable
None listed
Route Optimization & Analysis
Vendor
Blue Planet
Product
Route Optimization & Analysis
Platforms
Unknown
Default status
unaffected
Route Optimization & Analysis · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
<=24.04.1.2-R
affected
Unavailable
Unavailable
Unavailable
None listed
<=23.12.1.6-R
affected
Unavailable
Unavailable
Unavailable
None listed
<=23.08.1.6-R
affected
Unavailable
Unavailable
Unavailable
None listed
<=23.04.P01-9-R
affected
Unavailable
Unavailable
Unavailable
None listed
Unified Assurance & Analytics
Vendor
Blue Planet
Product
Unified Assurance & Analytics
Platforms
Unknown
Default status
unaffected
Unified Assurance & Analytics · Scoped product and version facts