8.0High

CVE-2025-9974Insufficient Input Validation on WEBUI in Nokia ONT/Beacon product

Nokia Nokia ONT Published: 2026-02-02 12:01 (9 months ago)

Description

The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated attacker may be able to execute arbitrary commands on the underlying ONT/Beacon operating system, potentially impacting the confidentiality, integrity, and availability of the device.

Weakness (CWE): CWE-78

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Nokia	Nokia ONT	Releases prior to BBDR2503, fixed BBDR2503 and later releases

References and patches

Nokia Security Advisory

CVSS score

8.0High

Source: CISA-ADP · CVSS 3.1

Attack vector: Adjacent
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

All scores (2)

CISA-ADP	CVSS 3.1	8.0High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.0High

EPSS (chance of exploitation in 30 days)

0.77%

higher than 56% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2025-09-04
Published2026-02-02 12:01
Reached IP-DB2026-10-25 00:01
Last updated2026-06-17 13:10

Assigned by (CNA): Nokia
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time