CVE-2007-3010

CVE-2007-3010 describes a critical command injection vulnerability in the masterCGI component of the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier. This flaw allows unauthenticated remote attackers to execute arbitrary commands on the affected server by injecting shell metacharacters into the 'user' parameter during a ping action. With a CVSS score of 9.8 (CRITICAL) and a FAUCET Risk Score of 100/100, this vulnerability poses a severe threat due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. This CVE is actively exploited in the wild, as confirmed by its presence in CISA's KEV catalog and recent media coverage. Numerous exploit intelligence sources, including Metasploit modules and Nuclei templates, provide readily available exploit code, indicating a high likelihood of successful exploitation. The vulnerability has garnered significant community attention with 11 mentions, placing it in the top 1% of all CVEs for discussion.