CVE-2007-3010

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

97.39% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2022-04-15

Nuclei

critical · CWE-20

Published

2007-09-18

Updated

2025-10-22

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2007/CVE-2007-3010.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/alcatel_omnipcx_maste…

ExploitDB entries (3)

• https://www.exploit-db.com/exploits/30591
• https://www.exploit-db.com/exploits/16857
• https://www.exploit-db.com/exploits/10031

Security advisories

• http://secunia.com/advisories/26853
• http://www.securityfocus.com/archive/1/479699/100/0/threaded
• http://www.securityfocus.com/bid/25694
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36632

References

• CVE Record
• NVD entry