CVE-2007-3010: al-enterprise omnipcx enterprise communicatio…

csirt@kutim:~/threat-intel/cve/CVE-2007-3010

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 97,4%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada al-enterprise omnipcx enterprise communication server. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 15 April 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.

Rincian

Terbit di NVD: 18 September 2007
Terakhir diubah: 16 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
EPSS (30 hari): 97,4% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
Masuk KEV: 15 April 2022
Tenggat CISA: 6 Mei 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
al-enterprise	omnipcx enterprise communication server	Semua versi hingga 7.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://secunia.com/advisories/26853 broken link · advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-3010 pemerintah AS
http://www.securityfocus.com/archive/1/479699/100/0/threaded broken link · advisory pihak ketiga · vdb entry
http://www.securityfocus.com/bid/25694 broken link · advisory pihak ketiga · vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/36632 advisory pihak ketiga · vdb entry
http://marc.info/?l=full-disclosure&m=119002152126755&w=2 exploit · mailing list
http://osvdb.org/40521 broken link
http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php broken link
http://www.vupen.com/english/advisories/2007/3185 broken link
http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm broken link

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.