202 lines
9.1 KiB
JSON
202 lines
9.1 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-5267",
|
||
"assignerOrgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Ciena",
|
||
"dateReserved": "2026-03-31T19:44:26.584Z",
|
||
"datePublished": "2026-09-25T19:10:46.330Z",
|
||
"dateUpdated": "2026-09-25T20:40:31.039Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "7bd90cf1-1651-495e-9ae8-9415fb3c9feb",
|
||
"shortName": "Ciena",
|
||
"dateUpdated": "2026-09-25T19:10:46.330Z"
|
||
},
|
||
"title": "Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"cweId": "CWE-306",
|
||
"description": "CWE-306 Missing authentication for critical function",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "Ciena",
|
||
"product": "Navigator NCS",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "7.2 and any older release"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "7.2-P01 through 7.2-P07"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "8.0"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "8.0-P01 through 8.0-P06A"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "8.1"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "8.1-P01 through 8.1-P06"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "8.2"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "8.2-P01 through 8.2-P06"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "9.0"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "9.0-P01 through 9.0-P05A"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "9.1"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "9.1-P01 through 9.1-P05"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "9.2"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "9.2-P01 through 9.2-P02"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "10.0"
|
||
},
|
||
{
|
||
"status": "affected",
|
||
"version": "10.0-P01 through 10.0-P01B"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Ciena Navigator Network\nControl Suite (NCS) contains an information exposure vulnerability in an\nevent-streaming API that does not properly enforce authentication. An\nunauthenticated attacker with network access to the affected service could\naccess the event stream and potentially obtain sensitive information.",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "<p>Ciena Navigator Network\nControl Suite (NCS) contains an information exposure vulnerability in an\nevent-streaming API that does not properly enforce authentication. An\nunauthenticated attacker with network access to the affected service could\naccess the event stream and potentially obtain sensitive information.</p>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://www.ciena.com/product-security"
|
||
}
|
||
],
|
||
"x_generator": {
|
||
"engine": "Vulnogram 1.0.1"
|
||
},
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Ciena recommends upgrading to the latest available remediated release. For additional details, refer to myciena.com for current software versions, fixes, and security advisories.\n\nRemediation and Fixes: \n\n\n\n\n \n \n \n\n Products \n\n\n \n \n \n\nRemediated Version\n\n\n \n \n \n \n \n\nNavigator NCS\n\n\n \n \n \n\n8.0-P06B and\n later\n\n\n \n\n8.1-P06A and\n later\n\n\n \n\n8.2-P07 and\n later\n\n\n \n\n9.0-P05B and\n later\n\n\n \n\n9.1-P05A and\n later\n\n\n \n\n9.2-P02A and\n later\n\n\n \n\n10.0-P01C and later",
|
||
"supportingMedia": [
|
||
{
|
||
"type": "text/html",
|
||
"base64": false,
|
||
"value": "Ciena recommends upgrading to the latest available remediated release. For additional details, refer to myciena.com for current software versions, fixes, and security advisories.<div><p><b>Remediation and Fixes: </b></p>\n\n<table>\n <tbody><tr>\n <td>\n <p><b> Products </b></p>\n </td>\n <td>\n <p><b>Remediated Version</b></p>\n </td>\n </tr>\n <tr>\n <td>\n <p>Navigator NCS</p>\n </td>\n <td>\n <p>8.0-P06B and\n later</p>\n <p>8.1-P06A and\n later</p>\n <p>8.2-P07 and\n later</p>\n <p>9.0-P05B and\n later</p>\n <p>9.1-P05A and\n later</p>\n <p>9.2-P02A and\n later</p>\n <p>10.0-P01C and later</p>\n </td>\n </tr>\n</tbody></table></div>"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Special thanks to Gev Manekshaw",
|
||
"type": "reporter"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "UNKNOWN"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "UNCHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 7.5,
|
||
"attackVector": "NETWORK",
|
||
"baseSeverity": "HIGH",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||
"integrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "LOW",
|
||
"availabilityImpact": "NONE",
|
||
"privilegesRequired": "NONE",
|
||
"confidentialityImpact": "HIGH"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-09-25T20:40:10.302755Z",
|
||
"id": "CVE-2026-5267",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-09-25T20:40:31.039Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |