by Kastro CVE-2025-52689
Alcatel-Lucent OmniAccess Stellar Products — Weak Session ID Check in the OmniAccess Stellar Web Management Interface
Description · from the CVE record
Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privileges by spoofing the login request, potentially allowing the attacker to modify the behaviour of the access point.
Affected
ProductAffectedFixed inSource
OmniAccess Stellar ProductsAP1100 AWOS versions 5.0.2 GA and earlier–CNA
OmniAccess Stellar ProductsAP1200 AWOS versions 5.0.2 GA and earlier–CNA
OmniAccess Stellar ProductsAP1300 AWOS versions 5.0.2 GA and earlier–CNA
OmniAccess Stellar ProductsAP1400 AWOS versions 5.0.2 GA and earlier–CNA
OmniAccess Stellar ProductsAP1500 AWOS versions 5.0.2 GA and earlier–CNA
Scores by source
CSA (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total