Nokia ONT/Beacon Command Injection Vulnerability in WEBUI Application

A command injection vulnerability has been identified in the unified WEBUI application of Nokia ONT/Beacon devices. This flaw allows authenticated users to execute arbitrary commands on the device's operating system. The vulnerability arises from inadequate validation of user input, enabling low-privileged authenticated attackers to disrupt the device's normal functioning and potentially compromise its confidentiality, integrity, and availability.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of system-level commands on the affected device, allowing an authenticated attacker to manipulate the device's operating system and potentially disrupt its normal operations or compromise sensitive information.

Remediation

Users can upgrade to version BBDR2503 or later to address this vulnerability. For more details, please contact Nokia support.