Vulnerability · Published Feb 2, 2026 · Assigned by Nokia
CVE-2025-9974Insufficient Input Validation on WEBUI in Nokia ONT/Beacon product
High 8.0
In plain English
A high-severity OS command injection in Nokia ONT from Nokia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated attacker may be able to execute arbitrary commands on the underlying ONT/Beacon operating system, potentially impacting the confidentiality, integrity, and availability of the device.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H