CVE-2024-2005 is a critical severity (CVSS 9.0) privilege escalation in Ciena Blue Planet products through version 22.12. A SAML misconfiguration is the cause, and only products using SAML authentication are affected. Ciena has released updates, available from its support portal.
What's affected
The NVD record says Blue Planet products through 22.12 are affected, and only those using SAML authentication. It says Ciena has released software updates that address the vulnerability and advises customers to upgrade to the latest version as soon as possible. The updates are downloaded from the Ciena Support Portal.
The record's CPE entry names Blue Planet Inventory. The record gives no list of fixed version numbers, and Ciena's product security page, the only reference, did not return readable text when I fetched it. Ask Ciena which release fixes your product and version.
NVD scores it 9.0 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The scope is changed and a low privilege account plus user interaction are needed.
How to check if you're exposed
Identify which Blue Planet products you run and which version each is on. Then check whether SAML single sign on is configured. If a product uses local authentication only, the record says it is not affected. If it uses SAML, treat it as in scope until you have installed the update.
Review your identity provider configuration for the product, and look at recent privilege or role changes inside it, since the flaw is about gaining higher privileges than assigned.
What to do now
- List Blue Planet products and versions, and note which use SAML.
- Download the update from the Ciena Support Portal and apply it per Ciena's instructions.
- Ask Ciena to confirm the fixed release for your exact product.
- Review roles and recent privilege changes in the affected products.
- Limit management access to the product to trusted networks until the update is in place.
Why it matters
NVD classifies this as CWE-269, improper privilege management. In SAML sign on, the identity provider asserts who a user is and which attributes or groups they hold, and the application decides what to allow. If the application's SAML setup maps or trusts those assertions incorrectly, a user can end up with more rights than intended.
A critical score with a low privilege requirement means any ordinary account on an affected system is a starting point. Orchestration and inventory platforms in network operations hold maps of infrastructure and sometimes the means to change it, so the blast radius of an admin takeover is wide. The KEV flag is false, and nothing I retrieved reports exploitation. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your projects pull in the affected component. Safeguard reachability analysis can then help you separate code paths that actually call the weak component from those that only list it.
Quick check
Does this affect Blue Planet products without SAML?
The record says only products using SAML authentication are affected.
Where do I get the fix?
The Ciena Support Portal, per the record. Ask Ciena for the exact fixed release.
Sources
Last reviewed: 19 October 2026.
