CVE-2007-3010 | BDVDB-2026-26359 Detail
AlcatelOmniPCX Enterprise
Description#
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
References#
- http://www.vupen.com/english/advisories/2007/3185
- http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php
- http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm
- http://secunia.com/advisories/26853
- http://marc.info/?l=full-disclosure&m=119002152126755&w=2
- http://osvdb.org/40521
- http://www.securityfocus.com/archive/1/479699/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36632
- http://www.securityfocus.com/bid/25694
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-3010
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.