by Kastro
Paper/Archive/CVE-2025-52688

CVE-2025-52688

Alcatel-Lucent OmniAccess Stellar Products — Command Injection Vulnerability in the OmniAccess Stellar Web Management Interface

EPSS 37%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.5.985 × 2019.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.

Affected

ProductAffectedFixed inSource
OmniAccess Stellar ProductsAP1100 AWOS versions 5.0.2 GA and earlier–CNA
OmniAccess Stellar ProductsAP1200 AWOS versions 5.0.2 GA and earlier–CNA
OmniAccess Stellar ProductsAP1300 AWOS versions 5.0.2 GA and earlier–CNA
OmniAccess Stellar ProductsAP1400 AWOS versions 5.0.2 GA and earlier–CNA
OmniAccess Stellar ProductsAP1500 AWOS versions 5.0.2 GA and earlier–CNA

Scores by source

CSA (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refcsa.gov.sg/alerts-and-advisories/alerts/al-2025-072refal-enterprise.com/-/media/assets/internet/documents/sa-n0150-omniaccess-stellar-multiple-vulnerabilities.pdfexploitjro.sg/CVEs/CVE-2025-52688