CVE-2007-3010 masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user...
CriticalCVSS 9.8
EPSS 97.4%
CISA KEV
added 2022-04-15 · due 2022-05-06
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
CISA Known Exploited Vulnerability
- Date added
- 2022-04-15
- Due date (FCEB)
- 2022-05-06
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| al-enterprise omnipcx enterprise communication server | <= 7.1 | No fix listed |
References
- 20070917 Alcatel-Lucent OmniPCX Remote Command Execution exploit mailing-list
- 40521 broken-link vdb-entry
- 26853 broken-link third-party-advisory vendor-advisory
- www.redteam-pentesting.de broken-link
- 20070917 Alcatel-Lucent OmniPCX Remote Command Execution broken-link mailing-list third-party-advisory vdb-entry
- 25694 broken-link third-party-advisory vdb-entry
- ADV-2007-3185 broken-link vdb-entry
- www1.alcatel-lucent.com broken-link
- alcatel-unified-mastercgi-command-execution(36632) third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource