EUVD-2026-44574
GHSA-6jrj-gphg-p8mj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Default creds are reachable network-side with no prior auth (AV:N/AC:L/PR:N), but the accounts are stated to have very limited permissions, so standalone impact is low (C:L/I:L/A:N); higher impact needs a separate chained flaw.
Primary rating from Vendor (7bd90cf1-1651-495e-9ae8-9415fb3c9feb).
CVSS VectorVendor: 7bd90cf1-1651-495e-9ae8-9415fb3c9feb
Lifecycle Timeline
4DescriptionCVE.org
In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker could combine an attack using one of these accounts with other potential weaknesses to launch a more significant attack, possibly leading to escalation of privilege on the system.
AnalysisAI
Predictable default credentials in Ciena's Navigator Network Control Suite (NCS), Manage Control Plane (MCP), and Planner Plus OnPrem expose hidden system accounts used for internal software operations to remote attackers. These accounts carry limited permissions in isolation, but their known default passwords give an attacker a foothold that can be chained with other weaknesses to escalate privilege on the management system. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, so exploitation remains theoretical rather than demonstrated.
Technical ContextAI
Ciena Navigator NCS and MCP are carrier-grade network and control-plane management platforms used by telecom operators to provision, monitor, and orchestrate optical and packet transport networks; Planner Plus OnPrem is the on-premises network planning component. The root cause is CWE-1393 (Use of Default Password): the software ships with hidden, built-in system accounts for internal inter-process or maintenance operations, and some of these accounts are provisioned with static, predictable default passwords. Because the credentials are embedded in the product design rather than generated per-deployment, any party who learns them (through reverse engineering, shared documentation, or reuse across installs) can authenticate as those accounts without a separate compromise.
RemediationAI
No exact fixed version was provided in the available data, so no vendor-released patch version can be independently confirmed at time of analysis; the affected-version upper bounds (Planner Plus OnPrem ≤ 4.1, MCP ≤ 8.0) imply remediated releases exist above those, but this must be confirmed directly with Ciena via the product security portal (https://www.ciena.com/product-security). As primary action, obtain and apply the vendor's fixed release and, where the platform permits, rotate or disable the affected built-in system accounts and change any default passwords. As compensating controls until patched: restrict network reachability of NCS/MCP/Planner Plus management and API interfaces to a dedicated management VLAN or jump-host network so the hidden accounts cannot be reached from general or untrusted networks (trade-off: may disrupt remote automation or integrations that rely on those interfaces); enforce network-level ACLs/firewall rules limiting access to known operator IPs; and monitor authentication logs for logins using the internal service accounts (trade-off: requires knowing the account names, which the vendor may need to supply). Because impact depends on chaining, also prioritize patching co-located weaknesses on the same host.
Same weakness CWE-1393 – Use of Default Password
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today