---
id: "CVE-2007-3010"
kind: "vulnerability"
aliases: ["CVE-2007-3010"]
title: "Alcatel OmniPCX Enterprise: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.97385
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Alcatel OmniPCX Enterprise", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["alcatel-omnipcx", "exploited", "infrastructure", "pbx", "telephony"]
not_affected_if: ["unknown"]
published_at: "2007-09-18T21:17:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2007-3010", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2007-3010", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-3010", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Alcatel OmniPCX Enterprise: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability

The masterCGI component in the Unified Maintenance Tool of Alcatel OmniPCX Enterprise communication servers lets remote attackers run arbitrary commands. Exploitation is confirmed in the wild and CISA lists it in the Known Exploited Vulnerabilities catalog.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Alcatel OmniPCX Enterprise affected ? fixed ?

## Fix

Apply the vendor update per Alcatel-Lucent instructions; the specific fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2007-3010
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2007-3010
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2007-3010

## From the sources

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_