CVE-2007-3010: Alcatel OmniPCX Enterprise masterCGI command injection via ping user parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a CVSS 9.8, KEV listing, and near-maximum EPSS makes this an urgent patch-or-isolate case.

What it is

The Unified Maintenance Tool's masterCGI in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier passes the user parameter unsanitized into a ping action, allowing shell metacharacter injection. An unauthenticated remote attacker can therefore run arbitrary commands on the server. This is a critical, network-reachable flaw in a telephony/communications platform.

Impact

An attacker gains arbitrary command execution with the privileges of the masterCGI process, enabling full compromise of the communication server. That can lead to data theft, service disruption, or use of the host as a pivot into the voice network.

Attack surface

Reachable over the network via the Unified Maintenance Tool's masterCGI endpoint, specifically the ping action's user parameter. The CVSS vector shows no privileges required and no user interaction, so it is exploitable pre-authentication if the endpoint is exposed.

Exploitation

It is listed in CISA KEV (added 2022-04-15) and has a very high EPSS probability (0.974, ~99.9th percentile), and a public exploit reference exists, indicating active exploitation and reliable weaponization. No ransomware campaign use is documented.

What to do

• Apply the vendor update per Alcatel instructions; upgrade OmniPCX Enterprise beyond R7.1 or apply the PSIRT-recommended fix.
• Restrict network access to the Unified Maintenance Tool/masterCGI interface to trusted management networks only.
• Do not expose the maintenance web interface to the internet or untrusted segments; place it behind a firewall or VPN.
• If patching is not possible, disable or block the ping action in masterCGI and monitor for parameter tampering.
• Review and harden the masterCGI service account so command execution has minimal privileges.

Detection

• Monitor web/proxy logs for requests to masterCGI with shell metacharacters (;, |, `, $(), &&) in the user parameter.
• Alert on unexpected child processes spawned by the web server or masterCGI, especially ping or shell interpreters.
• Hunt for outbound connections or command-and-control traffic originating from the OmniPCX server.
• Audit the Unified Maintenance Tool for unauthorized configuration changes or new accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.