Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2024-41925

Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion

Critical9.3EPSS 0.70%
Published
Updated
Reserved
Assigned by
icscert

Description

The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.

Timeline

  1. ID reserved

    By icscert

  2. · 17 days later

    Published

  3. · 1 day later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-41925, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)4.0Critical9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
icscertCNA (assigner)3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Deferred4.0Critical9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.70% · top 47% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

Affected products

What to do

Workaround: Optigo Networks recommends users always use a unique management VLAN for the port on the ONS-S8 that is used to connect to OneView. Optigo Networks also recommends users implement at least one of the following additional mitigations: * Use a dedicated NIC on the BMS computer and exclusively this computer for connecting to OneView to manage your OT network configuration. * Set up a router firewall with a white list for the devices permitted to access OneView. * Connect to OneView via secure VPN.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-41925 badge
[![CVE-2024-41925](https://trackcve.app/badge/CVE-2024-41925.svg)](https://trackcve.app/cve/CVE-2024-41925)

Record last updated .