Vulnerability · Published Jul 16, 2025 · Assigned by CSA
CVE-2025-52690Command Injection Vulnerability in the OmniAccess Stellar over UDP Service
High 8.1
In plain English
A high-severity command injection in OmniAccess Stellar Products from Alcatel-Lucent. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 14.4% (higher than 97% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)14.4%top 3.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Alcatel-Lucent | OmniAccess Stellar Products | AP1100 AWOS versions 5.0.2 GA and earlierAP1200 AWOS versions 5.0.2 GA and earlierAP1300 AWOS versions 5.0.2 GA and earlierAP1400 AWOS versions 5.0.2 GA and earlierAP1500 AWOS versions 5.0.2 GA and earlier |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H