critical9.8Known exploitedPublic exploit code
CVE-2007-3010
Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-04-15. Federal due date: 2022-05-06.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Alcatel-Lucent OmniPCX Enterprise 7.1 - Remote Command Execution2007-09-17 · webapps · cgi · Verified
- Alcatel-Lucent OmniPCX Enterprise - masterCGI Arbitrary Command Execution (Metasploit)2010-10-05 · webapps · cgi · Verified
- Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 - masterCGI Command Injection (Metasploit)2007-09-17 · webapps · cgi · Verified
Impact
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Al-Enterprise | Omnipcx Enterprise Communication Server | through 7.1 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://marc.info/?l=full-disclosure&m=119002152126755&w=2
- http://osvdb.org/40521
- http://secunia.com/advisories/26853
- http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php
- http://www.securityfocus.com/archive/1/479699/100/0/threaded
- http://www.securityfocus.com/bid/25694
- http://www.vupen.com/english/advisories/2007/3185
- http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36632
- http://marc.info/?l=full-disclosure&m=119002152126755&w=2
- http://osvdb.org/40521
- http://secunia.com/advisories/26853
- http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php
- http://www.securityfocus.com/archive/1/479699/100/0/threaded
- http://www.securityfocus.com/bid/25694
- http://www.vupen.com/english/advisories/2007/3185
- http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36632
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-3010