CVE-2025-9974

Question

CVE-2025-9974

Accepted Answer

**CVE-2025-9974** is a command injection vulnerability (CWE-78) affecting the unified WEBUI application of **Nokia ONT/Beacon** devices.

### Technical Summary
*   **Vulnerability Type:** OS Command Injection.
*   **Root Cause:** The application performs insufficient input validation when processing user-supplied data. Special characters and command separators are not properly sanitized or escaped before being passed to system-level command execution functions.
*   **Exploitation:** An authenticated attacker with low-level privileges, operating from an adjacent network, can leverage this flaw to execute arbitrary commands on the device's underlying operating system. 
*   **Impact:** Successful exploitation can compromise the confidentiality, integrity, and availability of the affected ONT/Beacon device.

### Mitigation
*   **Resolution:** Nokia has addressed this vulnerability in their software updates. Users are advised to upgrade to version **BBDR2503 or later** to remediate the issue.