CVE-2007-3010
- State
- Published
- Severity
- 9.8 Critical
- Published
- Sep 18, 2007
- Updated
- Oct 22, 2025
- Reserved
- Jun 4, 2007
Description
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- ADV-2007-3185vdb-entry
- http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php
- http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm
- 26853third-party-advisory
- 20070917 Alcatel-Lucent OmniPCX Remote Command Executionmailing-list
- 40521vdb-entry
- 20070917 Alcatel-Lucent OmniPCX Remote Command Executionmailing-list
- alcatel-unified-mastercgi-command-execution(36632)vdb-entry
- 25694vdb-entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-3010government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.