Alcatel-Lucent OmniAccess Stellar Multiple Vulnerabilities Advisory (CVE-2025-52687 to 52690)

Key Information Vulnerability Overview Title: Multiple Vulnerabilities in Alcatel-Lucent OmniAccess Stellar Products Release Date: 16 July 2023 Background: Alcatel-Lucent has released security updates addressing multiple vulnerabilities in its OmniAccess Stellar products (CVE-2025-52687, CVE-2025-52688, CVE-2025-52689, and CVE-2025-52690). Impact CVE-2025-52687: Successful exploitation allows an attacker to inject malicious JavaScript into web traffic using administrator credentials, potentially leading to session hijacking and denial of service. CVE-2025-52688: Successful exploitation allows an attacker to execute commands on the access point with root privileges, resulting in loss of confidentiality, integrity, availability, and complete control. CVSSv3.1 score: 9.8. CVE-2025-52689: Successful exploitation allows an unauthorized attacker to obtain a valid session ID by forging login requests, enabling modification of access point behavior. CVSSv3.1 score: 9.8. CVE-2025-52690: Successful exploitation allows an attacker to execute arbitrary commands with root privileges, resulting in loss of confidentiality, integrity, availability, and complete control. Affected Products AP1100 AWOS version 5.0.2 GA and earlier AP1200 AWOS version 5.0.2 GA and earlier AP1300 AWOS version 5.0.2 GA and earlier AP1400 AWOS version 5.0.2 GA and earlier AP1500 AWOS version 5.0.2 GA and earlier Mitigation Users and administrators should immediately contact their business partners and update to the latest version. Acknowledgments Thanks to the researchers who discovered these vulnerabilities, and appreciation for Alcatel’s cooperation in coordinating the disclosure of these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Alcatel-Lucent OmniAccess Stellar Multiple Vulnerabilities Advisory (CVE-2025-52687 to 52690)