High severity · published Jul 16, 2025
CVE-2025-52690
Command Injection Vulnerability in the OmniAccess Stellar over UDP Service
8.1
CVSS
14.4%
EPSS
No
On KEV
Description
Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)14.4% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
OmniAccess Stellar Products · Alcatel-Lucent
AP1100 AWOS versions 5.0.2 GA and earlier; AP1200 AWOS versions 5.0.2 GA and earlier; AP1300 AWOS versions 5.0.2 GA and earlier; AP1400 AWOS versions 5.0.2 GA and earlier; AP1500 AWOS versions 5.0.2 GA and earlier · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52690
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52690
jro.sg
https://jro.sg/CVEs/CVE-2025-52690/
www.al-enterprise.com
https://www.al-enterprise.com/-/media/assets/internet/documents/sa-n0150-omniaccess-stellar-multiple-vulnerabilities.pdf
www.csa.gov.sg
https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-072/
More from OmniAccess Stellar Products
9.8
CVE-2025-52689
Weak Session ID Check in the OmniAccess Stellar Web Management Interface
9.8
CVE-2025-52688
Command Injection Vulnerability in the OmniAccess Stellar Web Management Interface