PT-2026-5645 · Unknown · Ont/Beacon

Published 2026-02-02 · Updated 2026-02-07 · CVE-2025-9974

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ONT/Beacon devices (affected versions not specified)

Description The unified WEBUI application contains a flaw in how it handles user input. This allows authenticated users to potentially execute commands on the underlying operating system. Insufficient validation of user-supplied data enables a low-privileged attacker to execute arbitrary commands, which could compromise the confidentiality, integrity, and availability of the device. The flaw impacts the system level, allowing for unintended command execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-9974

Affected Products

Ont/Beacon

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9974 · Security Note
• https://nokia.com/we-are-nokia/security/product-security-advisory/cve-2025-9974 · Note
• https://twitter.com/TheHackerWire/status/2018368538436866240 · Twitter Post
• https://twitter.com/cracbot/status/2020090214442758275 · Twitter Post
• https://twitter.com/CVEnew/status/2018265125602640289 · Twitter Post
• https://t.me/CVEtracker/43461 · Telegram Post