Vulnerability · Published Jul 16, 2025 · Assigned by CSA
CVE-2025-52687JavaScript Injection Vulnerability in the OmniAccess Stellar Web Management Interface
Low 2.4
In plain English
A low-severity command injection in OmniAccess Stellar from Alcatel-Lucent. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)2.4Low
Exploit odds (30 days)0.3%top 83.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into the payload of web traffics, potentially leading to session hijacking and denial-of-service (DoS).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Alcatel-Lucent | OmniAccess Stellar | AP1100 AWOS versions 5.0.2 GA and earlierAP1200 AWOS versions 5.0.2 GA and earlierAP1300 AWOS versions 5.0.2 GA and earlierAP1400 AWOS versions 5.0.2 GA and earlierAP1500 AWOS versions 5.0.2 GA and earlier |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N