What’s Vulnerable › Vulnerabilities

CVE-2025-52687: JavaScript Injection Vulnerability in the OmniAccess Stellar Web Management Interface

• Severity: low (CVSS 2.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-16 · updated 2026-06-17
• Weakness: CWE-77

Description

Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into the payload of web traffics, potentially leading to session hijacking and denial-of-service (DoS).

Affected products

• Alcatel-Lucent OmniAccess Stellar: through AP1100 AWOS versions 5.0.2 GA; through AP1200 AWOS versions 5.0.2 GA; through AP1300 AWOS versions 5.0.2 GA; through AP1400 AWOS versions 5.0.2 GA; through AP1500 AWOS versions 5.0.2 GA

References

• https://www.al-enterprise.com/-/media/assets/internet/documents/sa-n0150-omniaccess-stellar-multiple-vulnerabilities.pdf
• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-072/

Get alerted when CVE-2025-52687 or the next vulnerability affects your stack