CVE-2024-41925: The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse…

PriorityP263critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.70%

48.5th percentile

The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
optigo_networks	ons-s8_spectra_aggregation_switch	<= 1.3.7	—

Detection & IOCsextracted from sources · hover to see the quote

→CVE-2024-41925 is a PHP Remote File Inclusion (RFI) vulnerability (CWE-98) in the ONS-S8 Spectra Aggregation Switch web service; detect exploitation attempts via directory traversal sequences in HTTP requests targeting the device's web interface ↗
→The vulnerability is classified as PHP Remote File Inclusion stemming from improper validation of user-supplied file paths; monitor HTTP requests to the ONS-S8 web service for path parameters containing remote URLs or traversal sequences (e.g., '../', 'http://', 'https://') ↗
→All ONS-S8 Spectra Aggregation Switch firmware versions 1.3.7 and prior are affected; flag any such device exposed to network access without VLAN isolation as a high-risk target ↗
→The vulnerability is remotely exploitable with low attack complexity, no privileges required, and no user interaction; prioritize detection of unauthenticated inbound HTTP/HTTPS connections to ONS-S8 management interfaces from unexpected sources ↗
→Successful exploitation can lead to arbitrary file upload in addition to RCE and directory traversal; monitor the ONS-S8 web service for unexpected POST requests with file upload content types from unauthenticated sessions ↗

·No patches are available as of the advisory date; mitigations are configuration-based only — isolate ONS-S8 management traffic on a dedicated VLAN ↗
·No known active exploitation has been observed at time of publication; however, the attack surface is broad (worldwide deployment, no auth required, low complexity) ↗
·CVE-2024-41925 affects the web service component specifically; the companion vulnerability CVE-2024-45367 (weak authentication/no password required) may be chained with this RFI flaw for full unauthenticated RCE ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.