CVE-2007-3010

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 16, 2026

Description

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=full-disclosure&m=119002152126755&w=2Exploit, Mailing List
http://osvdb.org/40521Broken Link
http://secunia.com/advisories/26853Broken Link, Vendor Advisory
http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.phpBroken Link
http://www.securityfocus.com/archive/1/479699/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/25694Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2007/3185Broken Link
http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htmBroken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/36632Third Party Advisory, VDB Entry
http://marc.info/?l=full-disclosure&m=119002152126755&w=2Exploit, Mailing List
http://osvdb.org/40521Broken Link
http://secunia.com/advisories/26853Broken Link, Vendor Advisory
http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.phpBroken Link
http://www.securityfocus.com/archive/1/479699/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/25694Broken Link, Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2007/3185Broken Link
http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htmBroken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/36632Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-3010US Government Resource

Timeline

Published: Sep 18, 2007
Last modified: Jun 16, 2026
Added to CISA KEV: Apr 15, 2022
NVD status: Analyzed

Related CVEs from 2007

CVE-2007-30117.5The DBAsciiAccess CGI Script in the web interface in Fujitsu-Siemens Computers ServerView before 4.50.09 allows remote attackers to execute CVE-2007-30125.0The web interface in Fujitsu-Siemens Computers PRIMERGY BX300 Switch Blade allows remote attackers to obtain sensitive information by cancel CVE-2007-30136.5SQL injection vulnerability in activeWeb contentserver before 5.6.2964 allows remote authenticated users with edit permission to execute arb CVE-2007-30144.3Multiple cross-site scripting (XSS) vulnerabilities in activeWeb contentserver before 5.6.2964 allow remote attackers to inject arbitrary we CVE-2007-30174.0The WYSIWYG editor applet in activeWeb contentserver CMS before 5.6.2964 only filters malicious tags from articles sent to admin/applets/wys CVE-2007-30184.0activeWeb contentserver CMS before 5.6.2964 does not limit the file-creation ability of editors who have restricted accounts, which allows t CVE-2007-30217.5Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec An CVE-2007-30224.3Symantec Reporting Server 1.0.197.0, and other versions before 1.0.224.0, as used in Symantec Client Security 3.1 and later, and Symantec An CVE-2007-302310.0unsp.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 does not properly calculate the end of a certain buffer, with unknown impact and remo CVE-2007-30242.1libclamav/others.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1 uses insecure permissions for temporary files that are created by the cli CVE-2007-30255.0Unspecified vulnerability in libclamav/phishcheck.c in ClamAV before 0.90.3 and 0.91 before 0.91rc1, when running on Solaris, allows remote CVE-2007-30269.3Integer overflow in Panda Software AdminSecure allows remote attackers to execute arbitrary code via crafted packets with modified length va