Low severity · published Jul 16, 2025
CVE-2025-52687
JavaScript Injection Vulnerability in the OmniAccess Stellar Web Management Interface
2.4
CVSS
0.3%
EPSS
No
On KEV
Description
Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into the payload of web traffics, potentially leading to session hijacking and denial-of-service (DoS).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
OmniAccess Stellar · Alcatel-Lucent
AP1100 AWOS versions 5.0.2 GA and earlier; AP1200 AWOS versions 5.0.2 GA and earlier; AP1300 AWOS versions 5.0.2 GA and earlier; AP1400 AWOS versions 5.0.2 GA and earlier; AP1500 AWOS versions 5.0.2 GA and earlier · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52687
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52687
www.al-enterprise.com
https://www.al-enterprise.com/-/media/assets/internet/documents/sa-n0150-omniaccess-stellar-multiple-vulnerabilities.pdf
www.csa.gov.sg
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-072/
