Critical severity · published Jul 16, 2025
CVE-2025-52688
Command Injection Vulnerability in the OmniAccess Stellar Web Management Interface
9.8
CVSS
37.1%
EPSS
No
On KEV
Description
Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)37.1% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
OmniAccess Stellar Products · Alcatel-Lucent
AP1100 AWOS versions 5.0.2 GA and earlier; AP1200 AWOS versions 5.0.2 GA and earlier; AP1300 AWOS versions 5.0.2 GA and earlier; AP1400 AWOS versions 5.0.2 GA and earlier; AP1500 AWOS versions 5.0.2 GA and earlier · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52688
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52688
jro.sg
https://jro.sg/CVEs/CVE-2025-52688/
www.al-enterprise.com
https://www.al-enterprise.com/-/media/assets/internet/documents/sa-n0150-omniaccess-stellar-multiple-vulnerabilities.pdf
www.csa.gov.sg
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-072/
More from OmniAccess Stellar Products
9.8
CVE-2025-52689
Weak Session ID Check in the OmniAccess Stellar Web Management Interface
8.1
CVE-2025-52690
Command Injection Vulnerability in the OmniAccess Stellar over UDP Service