Vulnerability Report

CVE-2025-9974

RCE

Title: Authenticated Command Execution in ONT/Beacon unified WEBUI

RCE

Proof Of Concept

PoC Available for CVE-2025-9974

CWE Category NVD-CWE-noinfo
Published Date Feb 02, 2026
Modified Date Apr 15, 2026
Exploit Status Available
Score 8.0 CVSS v
Exploit Probability (EPSS)
0.40%

Vulnerability Summary

CVE-2025-9974: The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated attacker may be able to execute arbitrary commands on the underlying ONT/Beacon operating system, potentially impacting the confidentiality, integrity, and availability of the device.

Impacted Vendors

Analysis in Progress...

Reference Links

https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-9974/
CVSS v3.1
Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0
Severity HIGH
8.0
Attack Vector
ADJACENT_NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2025-9974 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/Rajdave69/CVE-2025-9974
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector ADJACENT_NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.