Optigo Networks vulnerabilities
We track 6 vulnerabilities in Optigo Networks products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on May 6, 2025.
Latest Optigo Networks vulnerabilities
- 9.3 Critical severity
ONS NC600: Use of Hard-coded Credentials
In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components to perform OS command executions.
- 8.7 High severity
Visual BACnet Capture Tool: Use of Hard-coded, Security-relevant Constants
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 are vulnerable to an attacker impersonating the web application service and mislead victim clients.
- 9.3 Critical severity
Visual BACnet Capture Tool: Authentication Bypass Using an Alternate Path or Channel
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain an exposed web management service that could allow an attacker to bypass authentication measures and gain controls over utilities within the products.
- 8.7 High severity
Visual BACnet Capture Tool: Use of Hard-coded, Security-relevant Constants
Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool version 3.1.2rc11 contain a hard coded secret key. This could allow an attacker to generate valid JWT (JSON Web Token) sessions.
- 9.1 Critical severity
ONS-S8 Spectra Aggregation Switch: Weak Authentication
The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password.
- 9.8 Critical severity
ONS-S8 Spectra Aggregation Switch: Improper Control of Filename for Include/Require Statement in PHP Program
The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.