Is CVE-2007-3010 being actively exploited?

Yes. CVE-2007-3010 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on April 15, 2022.

What is the CVSS score for CVE-2007-3010?

CVE-2007-3010 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2007-3010

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 97.4%EU EUVD: exploited

masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-77
EPSS score: 97.4% (100th percentile)
In CISA KEV: Yes, added April 15, 2022
In EU EUVD: Yes (EUVD-2007-3002)
Published: September 18, 2007
NVD last modified: June 16, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability

Added to the KEV catalog on April 15, 2022; federal remediation due May 6, 2022.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2007-3002 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 22, 2025.

View on the EU Vulnerability Database

Affected products

al-enterprise / omnipcx enterprise communication server

References

http://marc.info/?l=full-disclosure&m=119002152126755&w=2(Exploit, Mailing List)
http://osvdb.org/40521(Broken Link)
http://secunia.com/advisories/26853(Broken Link, Vendor Advisory)
http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php(Broken Link)
http://www.securityfocus.com/archive/1/479699/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
http://www.securityfocus.com/bid/25694(Broken Link, Third Party Advisory, VDB Entry)
http://www.vupen.com/english/advisories/2007/3185(Broken Link)
http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm(Broken Link)
https://exchange.xforce.ibmcloud.com/vulnerabilities/36632(Third Party Advisory, VDB Entry)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-3010(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain