PT-2025-19913 · Optigo Networks · Optigo Networks Ons Nc600

Tomer Goldschmidt · Published 2025-05-06 · Updated 2025-05-12 · CVE-2025-4041

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330

Description An issue exists where an attacker could connect to the device's ssh server and utilize the system's components to perform OS command executions.

Recommendations For Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, consider changing the default username and password to prevent unauthorized access, and restrict access to the ssh server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-4041

Affected Products

Optigo Networks Ons Nc600

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-4041 · Security Note
• https://twitter.com/cybercronai/status/1920135426049736993 · Twitter Post
• https://twitter.com/cybercronai/status/1920256213108855164 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-126-01 · Note
• https://t.me/cvetracker/23198 · Telegram Post
• https://twitter.com/ethicalhack3r/status/1919819218389774833 · Twitter Post
• https://reddit.com/r/askclaroty/comments/1kkzv9h/vulnerability_disclosure_optigo_networks_ons_nc600 · Reddit Post
• https://t.me/cvedetector/24624 · Telegram Post
• https://twitter.com/CVEnew/status/1919796055295627566 · Twitter Post