VulnSocial

CVE-2025-9974Disclosure

LOWCVSS 8.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient validation of user-supplied data, a low-privileged authenticated attacker may be able to execute arbitrary commands on the underlying ONT/Beacon operating system, potentially impacting the confidentiality, integrity, and availability of the device.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 4 classified signals
  • Peaked 2d ago at 2 mentions (2026-02-02); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-02-02: 2Mentions · 2026-02-07: 1Mentions · 2026-07-09: 1Technical Details · 2026-02-02: 2Technical Details · 2026-02-07: 102-0202-0707-09
Signal classification1 categories
Disclosure
4100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-02-022
Disclosure2
2026-02-071
Disclosure1
2026-07-091
Disclosure1
Full discourse4 posts
  • maya (didn’t pay for checkmark)@JovannMC
    Disclosure

    i found a funny RCE on my ISP-provided Nokia ONT/router.. but sadly i'm a few months late for a CVE (CVE-2025-9974) oh well that was fun though. ISP disabled stuff like exporting configs, firmware upgrades, and changed the superadmin password (which is why i investigated) lol https://t.co/eIK8p6R1W5

    Post summary

    The user reports discovering an RCE (CVE-2025-9974) on an ISP‑provided Nokia ONT/router, without providing any PoC, exploit code, patch, or evidence of active exploitation.

    0001631.9K
    451 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2025-9974 The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execut… https://www.cve.org/CVERecord?id=CVE-2025-9974

    Post summary

    The text discloses an input handling flaw in the ONT/Beacon device’s unified WEBUI that permits authenticated users to execute system-level commands.

    00020321
    56.5K followersView on X
  • CRAC Learning - Tech@cracbot
    Disclosure

    CVE-2025-9974 (CVSS:8.0, HIGH) is Awaiting Analysis. The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users t..https://nvd.nist.gov/vuln/detail/CVE-2025-9974 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    Post summary

    CVE-2025-9974 is a high‑severity input handling flaw in the ONT/Beacon WEBUI, currently awaiting analysis, with no known exploits or patches mentioned.

    0000035
    171 followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2025-9974 - High The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level command execution. Due to insufficient... https://www.thehackerwire.com/vulnerability/CVE-2025-9974/ https://t.co/rgSE3WK3o8

    Post summary

    The post discloses a high‑severity input handling flaw in the ONT/Beacon device’s WEBUI that permits authenticated users to execute arbitrary system commands, and links to a vulnerability report.

    0000053
    113 followersView on X

Explore more

Back to dashboard