vulnwire
9.8crit

CVE-2007-3010KEVin critical feed4 exploitsNuclei template

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to ex…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2022-04-15
EPSS
97.4%
percentile 100%
Public exploits
4
Metasploit · Exploit-DB · Nuclei check

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.

Known exploited (CISA KEV)

Added
4 y ago
Due date
2022-05-06 (4 y ago)
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Vendor / product
Alcatel / OmniPCX Enterprise
CISA name
Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

97.39% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • Nuclei template Alcatel-Lucent OmniPCX - Remote Command Execution · nuclei detection template
  • Metasploit exploit/linux/http/alcatel_omnipcx_mastercgi_exec Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution · metasploit exploit, manual rank · 2007-09-09
  • EDB-30591 Alcatel-Lucent OmniPCX Enterprise 7.1 - Remote Command Execution · webapps · 2007-09-17
  • EDB-16857 Alcatel-Lucent OmniPCX Enterprise - masterCGI Arbitrary Command Execution (Metasploit) · webapps · 2010-10-05
  • EDB-10031 Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 - masterCGI Command Injection (Metasploit) · webapps · 2007-09-17

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

  • vupen.com /english/advisories/2007/3185 · vdb-entry, x_refsource_VUPEN, x_transferred
  • redteam-pentesting.de /advisories/rt-sa-2007-001.php · x_refsource_MISC, x_transferred
  • www1.alcatel-lucent.com /psirt/statements/2007002/OXEUMT.htm · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/26853 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • marc.info /?l=full-disclosure&m=119002152126755&w=2 · mailing-list, x_refsource_FULLDISC, x_transferred
  • osvdb.org /40521 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /archive/1/479699/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/36632 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/25694 · vdb-entry, x_refsource_BID, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-3010 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.