CVE-2025-52687

LowCVSS 2.4/10Last modified Jun 17, 2026

Description

Successful exploitation of the vulnerability could allow an attacker with administrator credentials for the access point to inject malicious JavaScript into the payload of web traffics, potentially leading to session hijacking and denial-of-service (DoS).

Metrics

CVSS 3.1 2.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
Alcatel-Lucent	OmniAccess Stellar	AP1100 AWOS versions 5.0.2 GA and earlier; AP1200 AWOS versions 5.0.2 GA and earlier; AP1300 AWOS versions 5.0.2 GA and earlier; AP1400 AWOS versions 5.0.2 GA and earlier; AP1500 AWOS versions 5.0.2 GA and earlier

References

Timeline

Published: Jul 16, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-526889.8Successful exploitation of the vulnerability could allow an attacker to inject commands with root privileges on the access point, potentiall CVE-2025-526899.8Successful exploitation of the vulnerability could allow an unauthenticated attacker to obtain a valid session ID with administrator privile CVE-2025-52698.1Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that w CVE-2025-526908.1Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss CVE-2025-5269110.0Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail s CVE-2025-526928.8Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access cer CVE-2025-526949.8Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands CVE-2025-52707.5In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and CVE-2025-527076.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fanc CVE-2025-527087.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY wo CVE-2025-52716.5Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in F CVE-2025-527105.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team File Manager Pro filester a