CVE-2007-3010
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1...
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
- Record
CVE-2007-3010- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
- Record
CVE-2007-3010- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2007-3002
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
- Record
EUVD-2007-3002- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-27fx-q398-q8vr
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1...
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
- Record
GHSA-27fx-q398-q8vr- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-77
- Updated
- 2026-11-02
CISA KEV No score
Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server allows remote attackers to execute arbitrary commands.
- Record
CVE-2007-3010- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution | 2007-09-09 |
| Exploit-DB | Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 - masterCGI Command Injection (Metasploit) | 2007-09-17 |
| Exploit-DB | Alcatel-Lucent OmniPCX Enterprise 7.1 - Remote Command Execution | 2007-09-17 |
| Exploit-DB | Alcatel-Lucent OmniPCX Enterprise - masterCGI Arbitrary Command Execution (Metasploit) | 2010-10-05 |
| Nuclei | Alcatel-Lucent OmniPCX - Remote Command Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| aliases, cwes, exploits, facts, kev, products, references, title | EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3010 is a critical vulnerability (CVSS 9.8) in Al-enterprise Omnipcx Enterprise Communication Server, published September 18, 2007. CISA lists it as known to be exploited, since April 15, 2022. EUVD reports exploitation since April 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.4%, the 99th percentile. No source names a fixed version.