CVE-2025-4041 - Use of Hard-coded Credentials Optigo Networks ONS NC600

Back Back to CVE browser

CRITICAL

Use of Hard-coded Credentials Optigo Networks ONS NC600

Published May 6, 2025

9.3

CRITICAL

CVSS 4.0

EPSS 0.74%

Description

In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions.

Affected products

Vendor Optigo Networks Product Ons Nc600 Default
unaffected
- Version
  4.2.1-084
  Status
  affected
  Constraints
  <=4.7.2-330

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Optigo Networks

Ons Nc600

unaffected

Version	Status	Constraints
4.2.1-084	affected	<=4.7.2-330

Remediation

Vendor solution

Optigo Networks recommends users implement at least one of the following additional mitigations:

* Use a dedicated NIC on the BMS computer and exclusively use the computer for connecting to OneView to manage your OT network configuration. * Set up a router firewall with a white list for the devices permitted to access OneView. * Connect to OneView via secure VPN.

Weaknesses (1)

CWE-798

Hard-coded Credentials