CVE-2007-3010
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 97% (percentile: 100) as of 1 November 2026
- CWE
- CWE-77
Affected products
al-enterprise: omnipcx enterprise communication server
References
- http://secunia.com/advisories/26853 Broken LinkVendor Advisory
- http://secunia.com/advisories/26853 Broken LinkVendor Advisory
- http://marc.info/?l=full-disclosure&m=119002152126755&w=2 ExploitMailing List
- http://marc.info/?l=full-disclosure&m=119002152126755&w=2 ExploitMailing List
- http://osvdb.org/40521 Broken Link
- http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php Broken Link
- http://www.securityfocus.com/archive/1/479699/100/0/threaded Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/25694 Broken LinkThird Party AdvisoryVDB Entry
- http://www.vupen.com/english/advisories/2007/3185 Broken Link
- http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm Broken Link