What’s Vulnerable › Vulnerabilities

CVE-2025-52688: Command Injection Vulnerability in the OmniAccess Stellar Web Management Interface

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 37.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-16 · updated 2026-06-17
• Weakness: CWE-77

Description

Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.

Affected products

• Alcatel-Lucent OmniAccess Stellar Products: through AP1100 AWOS versions 5.0.2 GA; through AP1200 AWOS versions 5.0.2 GA; through AP1300 AWOS versions 5.0.2 GA; through AP1400 AWOS versions 5.0.2 GA; through AP1500 AWOS versions 5.0.2 GA

References

• https://jro.sg/CVEs/CVE-2025-52688/
• https://www.al-enterprise.com/-/media/assets/internet/documents/sa-n0150-omniaccess-stellar-multiple-vulnerabilities.pdf
• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-072/
• https://jro.sg/CVEs/CVE-2025-52688/

Get alerted when CVE-2025-52688 or the next vulnerability affects your stack