What’s Vulnerable › Vulnerabilities

CVE-2025-52690: Command Injection Vulnerability in the OmniAccess Stellar over UDP Service

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-16 · updated 2026-06-17
• Weakness: CWE-77

Description

Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.

Affected products

• Alcatel-Lucent OmniAccess Stellar Products: through AP1100 AWOS versions 5.0.2 GA; through AP1200 AWOS versions 5.0.2 GA; through AP1300 AWOS versions 5.0.2 GA; through AP1400 AWOS versions 5.0.2 GA; through AP1500 AWOS versions 5.0.2 GA

References

• https://jro.sg/CVEs/CVE-2025-52690/
• https://www.al-enterprise.com/-/media/assets/internet/documents/sa-n0150-omniaccess-stellar-multiple-vulnerabilities.pdf
• https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-072/
• https://jro.sg/CVEs/CVE-2025-52690/

Get alerted when CVE-2025-52690 or the next vulnerability affects your stack