EUVD-2026-41884
GHSA-m6c7-7xhp-6vhc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Default SFTP server is remotely reachable and bypasses auth, so AV:N/AC:L/PR:N/UI:N; read and modify of system files gives C:H/I:H, and no described DoS gives A:N.
Primary rating from Vendor (Ciena).
CVSS VectorVendor: Ciena
Lifecycle Timeline
3DescriptionCVE.org
An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlying filesystem. Successful exploitation could allow an attacker to read or modify system files.
AnalysisAI
Authentication bypass in the default SFTP server component shared across Ciena's 6500 S-Series, 6500 T-Series, PTS, and CPL packet-optical transport platforms allows a remote, unauthenticated attacker to reach the underlying filesystem and read or modify system files. Rated CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified as CWE-288, the flaw undermines the primary access control on management-plane file transfer. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
The affected component is the SFTP (SSH File Transfer Protocol) server that ships enabled by default on Ciena's optical/packet transport network elements. SFTP normally rides atop an SSH session that authenticates the client before any filesystem operation is permitted; CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates the implementation exposes a route to file operations that skips or short-circuits that authentication check, so the server treats an unauthenticated peer as authorized. Because the same SFTP stack is reused across the 6500 S-Series, 6500 T-Series, PTS, and CPL product lines (per the CPE list cpe:2.3:a:ciena:6500_s-series, :6500_t-series, :pts, :cpl), a single code defect propagates the exposure across the entire product family. The 6500 family is a widely used carrier-grade packet-optical transport platform managing DWDM/OTN and packet services in service-provider and large-enterprise backbones.
RemediationAI
Upgrade each affected platform to a Ciena release later than the listed vulnerable versions - 6500 S-Series beyond R16.96, 6500 T-Series and PTS beyond R16.1, and CPL beyond R12.63 - using the fixed builds identified in Ciena's advisory at https://www.ciena.com/product-security (no vendor-released patch version is independently confirmed from the available data, so obtain exact fixed builds from Ciena support). Because the exposure is the default SFTP server on the management plane, the highest-value compensating control until patched is to remove network reachability: restrict TCP/22 (SFTP/SSH) on these network elements to a dedicated out-of-band management network and trusted jump hosts via ACLs or firewall rules, and disable the SFTP server on any element that does not require it - the trade-off is that in-band file transfer, remote backups, and software-load workflows that depend on SFTP will break and must be moved to the restricted management path. Monitor SFTP/SSH connection logs on these elements for anomalous or unauthenticated file access attempts.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today