Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
12 vulnerabilities by Optigo Networks
CVE-2025-4041 (GCVE-0-2025-4041)
Vulnerability from nvd – Published: 2025-05-06 16:35 – Updated: 2025-05-06 17:29
VLAI
EPSS
VEX
Title
Use of Hard-coded Credentials Optigo Networks ONS NC600
Summary
In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-06 17:28 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | ONS NC600 |
Affected:
4.2.1-084 , ≤ 4.7.2-330
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-4041",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-06T17:28:36.569696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-06T17:29:11.988Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ONS NC600",
"vendor": "Optigo Networks",
"versions": [
{
"lessThanOrEqual": "4.7.2-330",
"status": "affected",
"version": "4.2.1-084",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomer Goldschmidt of Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device\u0027s ssh server and utilize the system\u0027s components to perform OS command executions.\u003c/p\u003e"
}
],
"value": "In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device\u0027s ssh server and utilize the system\u0027s components to perform OS command executions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-06T16:35:18.133Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users implement at least one of the following additional mitigations:\u003c/p\u003e\u003cul\u003e\u003cli\u003eUse a dedicated NIC on the BMS computer and exclusively use the computer for connecting to OneView to manage your OT network configuration.\u003c/li\u003e\u003cli\u003eSet up a router firewall with a white list for the devices permitted to access OneView.\u003c/li\u003e\u003cli\u003eConnect to OneView via secure VPN.\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
}
],
"value": "Optigo Networks recommends users implement at least one of the following additional mitigations:\n\n * Use a dedicated NIC on the BMS computer and exclusively use the computer for connecting to OneView to manage your OT network configuration.\n * Set up a router firewall with a white list for the devices permitted to access OneView.\n * Connect to OneView via secure VPN."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use of Hard-coded Credentials Optigo Networks ONS NC600",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-4041",
"datePublished": "2025-05-06T16:35:18.133Z",
"dateReserved": "2025-04-28T14:39:33.460Z",
"dateUpdated": "2025-05-06T17:29:11.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2081 (GCVE-0-2025-2081)
Vulnerability from nvd – Published: 2025-03-13 17:00 – Updated: 2026-08-26 13:43
VLAI
EPSS
VEX
Title
Use of Hard-Coded, Security-Relevant Constants
Summary
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-13 18:42 UTC
CWE
- CWE-547 - Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool/Optigo Visual Networks Capture Tool
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | Visual BACnet Capture Tool |
Affected:
3.1.2rc11
|
|
| Optigo Networks | Optigo Visual Networks Capture Tool |
Affected:
3.1.2rc11
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2081",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-13T18:42:48.492300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T18:42:58.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Visual BACnet Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Optigo Visual Networks Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomer Goldschmidt of Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eOptigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-547",
"description": "CWE-547 Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool/Optigo Visual Networks Capture Tool",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:43:01.114Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026amp; ARM)\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Optigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\n\n * \n\nWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\n\n\n * \n\nLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026 ARM)"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use of Hard-Coded, Security-Relevant Constants",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-2081",
"datePublished": "2025-03-13T17:00:03.146Z",
"dateReserved": "2025-03-06T22:01:49.726Z",
"dateUpdated": "2026-08-26T13:43:01.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-2080 (GCVE-0-2025-2080)
Vulnerability from nvd – Published: 2025-03-13 16:57 – Updated: 2026-08-26 13:41
VLAI
EPSS
VEX
Title
Authentication Bypass Using an Alternate Path or Channel in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool
Summary
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-13 18:46 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | Visual BACnet Capture Tool |
Affected:
3.1.2rc11
|
|
| Optigo Networks | Optigo Visual Networks Capture Tool |
Affected:
3.1.2rc11
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2080",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-13T18:46:34.960491Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T18:46:42.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Visual BACnet Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Optigo Visual Networks Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomer Goldschmidt of Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003eOptigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.\u003c/p\u003e"
}
],
"value": "Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:41:33.219Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026amp; ARM)\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Optigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\n\n * \n\nWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\n\n\n * \n\nLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026 ARM)"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authentication Bypass Using an Alternate Path or Channel in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-2080",
"datePublished": "2025-03-13T16:57:30.147Z",
"dateReserved": "2025-03-06T22:01:47.991Z",
"dateUpdated": "2026-08-26T13:41:33.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-2079 (GCVE-0-2025-2079)
Vulnerability from nvd – Published: 2025-03-13 16:55 – Updated: 2026-08-26 13:43
VLAI
EPSS
VEX
Title
Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool
Summary
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-13 18:49 UTC
CWE
- CWE-547 - Use of Hard-Coded, Security-Relevant Constants
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | Visual BACnet Capture Tool |
Affected:
3.1.2rc11
|
|
| Optigo Networks | Optigo Visual Networks Capture Tool |
Affected:
3.1.2rc11
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2079",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-13T18:49:38.525761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T18:49:46.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Visual BACnet Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Optigo Visual Networks Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomer Goldschmidt of Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-547",
"description": "CWE-547 Use of Hard-Coded, Security-Relevant Constants",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:43:29.864Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026amp; ARM)\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Optigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\n\n * \n\nWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\n\n\n * \n\nLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026 ARM)"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-2079",
"datePublished": "2025-03-13T16:55:27.567Z",
"dateReserved": "2025-03-06T22:01:46.732Z",
"dateUpdated": "2026-08-26T13:43:29.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-45367 (GCVE-0-2024-45367)
Vulnerability from nvd – Published: 2024-10-03 22:19 – Updated: 2024-10-04 14:24
VLAI
EPSS
VEX
Title
Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authentication
Summary
The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-04 14:16 UTC
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | ONS-S8 Spectra Aggregation Switch |
Affected:
0 , ≤ 1.3.7
(custom)
|
|
| optigo | ons-s8_firmware |
Affected:
0 , ≤ 1.3.7
(custom)
cpe:2.3:o:optigo:ons-s8_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:optigo:ons-s8_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "ons-s8_firmware",
"vendor": "optigo",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45367",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-04T14:16:15.624896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-04T14:24:41.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ONS-S8 Spectra Aggregation Switch",
"vendor": "Optigo Networks",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Claroty Team82 reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password.\u003c/span\u003e\n\n\u003c/span\u003e"
}
],
"value": "The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T22:19:35.215Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-01"
}
],
"source": {
"advisory": "ICSA-24-275-01",
"discovery": "EXTERNAL"
},
"title": "Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authentication",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView.\u003c/p\u003e\u003cp\u003eOptigo Networks also recommends users implement at least one of the following additional mitigations:\u003c/p\u003e\u003cul\u003e\u003cli\u003eUse a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration.\u003c/li\u003e\u003cli\u003eSet up a router firewall with a white list for the devices permitted to access OneView.\u003c/li\u003e\u003cli\u003eConnect to OneView via secure VPN.\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
}
],
"value": "Optigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView.\n\nOptigo Networks also recommends users implement at least one of the following additional mitigations:\n\n * Use a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration.\n * Set up a router firewall with a white list for the devices permitted to access OneView.\n * Connect to OneView via secure VPN."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-45367",
"datePublished": "2024-10-03T22:19:35.215Z",
"dateReserved": "2024-09-16T16:21:37.452Z",
"dateUpdated": "2024-10-04T14:24:41.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41925 (GCVE-0-2024-41925)
Vulnerability from nvd – Published: 2024-10-03 22:17 – Updated: 2024-10-04 14:25
VLAI
EPSS
VEX
Title
Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion
Summary
The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-04 14:24 UTC
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | ONS-S8 Spectra Aggregation Switch |
Affected:
0 , ≤ 1.3.7
(custom)
|
|
| optigo | ons-s8_firmware |
Affected:
0 , ≤ 1.3.7
(custom)
cpe:2.3:o:optigo:ons-s8_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:optigo:ons-s8_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "ons-s8_firmware",
"vendor": "optigo",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-04T14:24:59.937952Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-04T14:25:26.785Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ONS-S8 Spectra Aggregation Switch",
"vendor": "Optigo Networks",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Claroty Team82 reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.\u003c/span\u003e"
}
],
"value": "The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T22:17:31.725Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-01"
}
],
"source": {
"advisory": "ICSA-24-275-01",
"discovery": "EXTERNAL"
},
"title": "Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView.\u003c/p\u003e\u003cp\u003eOptigo Networks also recommends users implement at least one of the following additional mitigations:\u003c/p\u003e\u003cul\u003e\u003cli\u003eUse a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration.\u003c/li\u003e\u003cli\u003eSet up a router firewall with a white list for the devices permitted to access OneView.\u003c/li\u003e\u003cli\u003eConnect to OneView via secure VPN.\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
}
],
"value": "Optigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView.\n\nOptigo Networks also recommends users implement at least one of the following additional mitigations:\n\n * Use a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration.\n * Set up a router firewall with a white list for the devices permitted to access OneView.\n * Connect to OneView via secure VPN."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-41925",
"datePublished": "2024-10-03T22:17:31.725Z",
"dateReserved": "2024-09-16T16:21:37.465Z",
"dateUpdated": "2024-10-04T14:25:26.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-4041 (GCVE-0-2025-4041)
Vulnerability from cvelistv5 – Published: 2025-05-06 16:35 – Updated: 2025-05-06 17:29
VLAI
EPSS
VEX
Title
Use of Hard-coded Credentials Optigo Networks ONS NC600
Summary
In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-06 17:28 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | ONS NC600 |
Affected:
4.2.1-084 , ≤ 4.7.2-330
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-4041",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-06T17:28:36.569696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-06T17:29:11.988Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ONS NC600",
"vendor": "Optigo Networks",
"versions": [
{
"lessThanOrEqual": "4.7.2-330",
"status": "affected",
"version": "4.2.1-084",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomer Goldschmidt of Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device\u0027s ssh server and utilize the system\u0027s components to perform OS command executions.\u003c/p\u003e"
}
],
"value": "In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device\u0027s ssh server and utilize the system\u0027s components to perform OS command executions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-06T16:35:18.133Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-126-01"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users implement at least one of the following additional mitigations:\u003c/p\u003e\u003cul\u003e\u003cli\u003eUse a dedicated NIC on the BMS computer and exclusively use the computer for connecting to OneView to manage your OT network configuration.\u003c/li\u003e\u003cli\u003eSet up a router firewall with a white list for the devices permitted to access OneView.\u003c/li\u003e\u003cli\u003eConnect to OneView via secure VPN.\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
}
],
"value": "Optigo Networks recommends users implement at least one of the following additional mitigations:\n\n * Use a dedicated NIC on the BMS computer and exclusively use the computer for connecting to OneView to manage your OT network configuration.\n * Set up a router firewall with a white list for the devices permitted to access OneView.\n * Connect to OneView via secure VPN."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use of Hard-coded Credentials Optigo Networks ONS NC600",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-4041",
"datePublished": "2025-05-06T16:35:18.133Z",
"dateReserved": "2025-04-28T14:39:33.460Z",
"dateUpdated": "2025-05-06T17:29:11.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-2081 (GCVE-0-2025-2081)
Vulnerability from cvelistv5 – Published: 2025-03-13 17:00 – Updated: 2026-08-26 13:43
VLAI
EPSS
VEX
Title
Use of Hard-Coded, Security-Relevant Constants
Summary
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-13 18:42 UTC
CWE
- CWE-547 - Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool/Optigo Visual Networks Capture Tool
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | Visual BACnet Capture Tool |
Affected:
3.1.2rc11
|
|
| Optigo Networks | Optigo Visual Networks Capture Tool |
Affected:
3.1.2rc11
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2081",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-13T18:42:48.492300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T18:42:58.126Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Visual BACnet Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Optigo Visual Networks Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomer Goldschmidt of Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eOptigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-547",
"description": "CWE-547 Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool/Optigo Visual Networks Capture Tool",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:43:01.114Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026amp; ARM)\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Optigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\n\n * \n\nWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\n\n\n * \n\nLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026 ARM)"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use of Hard-Coded, Security-Relevant Constants",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-2081",
"datePublished": "2025-03-13T17:00:03.146Z",
"dateReserved": "2025-03-06T22:01:49.726Z",
"dateUpdated": "2026-08-26T13:43:01.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-2080 (GCVE-0-2025-2080)
Vulnerability from cvelistv5 – Published: 2025-03-13 16:57 – Updated: 2026-08-26 13:41
VLAI
EPSS
VEX
Title
Authentication Bypass Using an Alternate Path or Channel in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool
Summary
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-13 18:46 UTC
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | Visual BACnet Capture Tool |
Affected:
3.1.2rc11
|
|
| Optigo Networks | Optigo Visual Networks Capture Tool |
Affected:
3.1.2rc11
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2080",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-13T18:46:34.960491Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T18:46:42.625Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Visual BACnet Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Optigo Visual Networks Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomer Goldschmidt of Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003eOptigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.\u003c/p\u003e"
}
],
"value": "Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:41:33.219Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026amp; ARM)\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Optigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\n\n * \n\nWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\n\n\n * \n\nLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026 ARM)"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authentication Bypass Using an Alternate Path or Channel in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-2080",
"datePublished": "2025-03-13T16:57:30.147Z",
"dateReserved": "2025-03-06T22:01:47.991Z",
"dateUpdated": "2026-08-26T13:41:33.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-2079 (GCVE-0-2025-2079)
Vulnerability from cvelistv5 – Published: 2025-03-13 16:55 – Updated: 2026-08-26 13:43
VLAI
EPSS
VEX
Title
Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool
Summary
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-13 18:49 UTC
CWE
- CWE-547 - Use of Hard-Coded, Security-Relevant Constants
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/i… | government-resource |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | Visual BACnet Capture Tool |
Affected:
3.1.2rc11
|
|
| Optigo Networks | Optigo Visual Networks Capture Tool |
Affected:
3.1.2rc11
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-2079",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-13T18:49:38.525761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-13T18:49:46.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Visual BACnet Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Optigo Visual Networks Capture Tool",
"vendor": "Optigo Networks",
"versions": [
{
"status": "affected",
"version": "3.1.2rc11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomer Goldschmidt of Claroty Team82"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.\u003c/p\u003e\u003cbr\u003e"
}
],
"value": "Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-547",
"description": "CWE-547 Use of Hard-Coded, Security-Relevant Constants",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:43:29.864Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-070-02"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003eWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026amp; ARM)\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Optigo Networks recommends users to upgrade to the following Ubuntu or Windows versions of Optigo Visual Networks Capture Tool version 3.2.1.80.\n\n * \n\nWindows: https://optigo.zendesk.com/hc/en-us/articles/47648910851725-Optigo-Networks-Capture-Tool-Windows-3-2-1-80-Current-Version\n\n\n * \n\nLinux: https://optigo.zendesk.com/hc/en-us/articles/47649041422861-Optigo-Networks-Capture-Tool-Linux-Ubuntu-3-2-1-80-Current-Version (Ubuntu - Intel \u0026 ARM)"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Use of Hard-Coded, Security-Relevant Constants in Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2025-2079",
"datePublished": "2025-03-13T16:55:27.567Z",
"dateReserved": "2025-03-06T22:01:46.732Z",
"dateUpdated": "2026-08-26T13:43:29.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-45367 (GCVE-0-2024-45367)
Vulnerability from cvelistv5 – Published: 2024-10-03 22:19 – Updated: 2024-10-04 14:24
VLAI
EPSS
VEX
Title
Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authentication
Summary
The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-04 14:16 UTC
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | ONS-S8 Spectra Aggregation Switch |
Affected:
0 , ≤ 1.3.7
(custom)
|
|
| optigo | ons-s8_firmware |
Affected:
0 , ≤ 1.3.7
(custom)
cpe:2.3:o:optigo:ons-s8_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:optigo:ons-s8_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "ons-s8_firmware",
"vendor": "optigo",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45367",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-04T14:16:15.624896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-04T14:24:41.220Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ONS-S8 Spectra Aggregation Switch",
"vendor": "Optigo Networks",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Claroty Team82 reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password.\u003c/span\u003e\n\n\u003c/span\u003e"
}
],
"value": "The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1390",
"description": "CWE-1390",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T22:19:35.215Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-01"
}
],
"source": {
"advisory": "ICSA-24-275-01",
"discovery": "EXTERNAL"
},
"title": "Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authentication",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView.\u003c/p\u003e\u003cp\u003eOptigo Networks also recommends users implement at least one of the following additional mitigations:\u003c/p\u003e\u003cul\u003e\u003cli\u003eUse a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration.\u003c/li\u003e\u003cli\u003eSet up a router firewall with a white list for the devices permitted to access OneView.\u003c/li\u003e\u003cli\u003eConnect to OneView via secure VPN.\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
}
],
"value": "Optigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView.\n\nOptigo Networks also recommends users implement at least one of the following additional mitigations:\n\n * Use a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration.\n * Set up a router firewall with a white list for the devices permitted to access OneView.\n * Connect to OneView via secure VPN."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-45367",
"datePublished": "2024-10-03T22:19:35.215Z",
"dateReserved": "2024-09-16T16:21:37.452Z",
"dateUpdated": "2024-10-04T14:24:41.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-41925 (GCVE-0-2024-41925)
Vulnerability from cvelistv5 – Published: 2024-10-03 22:17 – Updated: 2024-10-04 14:25
VLAI
EPSS
VEX
Title
Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion
Summary
The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-04 14:24 UTC
CWE
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Optigo Networks | ONS-S8 Spectra Aggregation Switch |
Affected:
0 , ≤ 1.3.7
(custom)
|
|
| optigo | ons-s8_firmware |
Affected:
0 , ≤ 1.3.7
(custom)
cpe:2.3:o:optigo:ons-s8_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:optigo:ons-s8_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "ons-s8_firmware",
"vendor": "optigo",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-41925",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-04T14:24:59.937952Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-04T14:25:26.785Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ONS-S8 Spectra Aggregation Switch",
"vendor": "Optigo Networks",
"versions": [
{
"lessThanOrEqual": "1.3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Claroty Team82 reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.\u003c/span\u003e"
}
],
"value": "The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-98",
"description": "CWE-98",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-03T22:17:31.725Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-275-01"
}
],
"source": {
"advisory": "ICSA-24-275-01",
"discovery": "EXTERNAL"
},
"title": "Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOptigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView.\u003c/p\u003e\u003cp\u003eOptigo Networks also recommends users implement at least one of the following additional mitigations:\u003c/p\u003e\u003cul\u003e\u003cli\u003eUse a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration.\u003c/li\u003e\u003cli\u003eSet up a router firewall with a white list for the devices permitted to access OneView.\u003c/li\u003e\u003cli\u003eConnect to OneView via secure VPN.\u003c/li\u003e\u003c/ul\u003e\n\n\u003cbr\u003e"
}
],
"value": "Optigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView.\n\nOptigo Networks also recommends users implement at least one of the following additional mitigations:\n\n * Use a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration.\n * Set up a router firewall with a white list for the devices permitted to access OneView.\n * Connect to OneView via secure VPN."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2024-41925",
"datePublished": "2024-10-03T22:17:31.725Z",
"dateReserved": "2024-09-16T16:21:37.465Z",
"dateUpdated": "2024-10-04T14:25:26.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}