Exploited CVEs / CVE-2007-3010
CVE-2007-3010
Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability. Exploitation in the wild is confirmed by CISA, not predicted. Federal agencies were required to remediate by 2022-05-06 (that deadline has passed); treat that date as the outer bound for your own environment. Check the vendor security advisory for the fix.
Actively exploited Alcatel OmniPCX Enterprise vulnerability, Critical severity, CVSS 9.8. Added to the CISA KEV catalog 2022-04-15.
Risk summary
Updated July 25, 2026. Data refreshed on every build from MSRC, CISA KEV, and FIRST EPSS.
Senserva AI Opinion for CVE-2007-3010
CVE-2007-3010 is a remote command execution flaw in masterCGI, part of the Unified Maintenance Tool that ships with Alcatel OmniPCX Enterprise Communication Server. An unauthenticated attacker who can reach the web management interface can pass shell metacharacters through masterCGI to run arbitrary operating system commands on the appliance, which typically runs as a privileged account on the call server. Two things make this specific PBX bug worth acting on now rather than treating it as a 2007 relic: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-04-15, meaning exploitation against real targets has been confirmed, and the EPSS score of 98 percent reflects that working exploit code for masterCGI is public and widely reused. There is no reported ransomware campaign tied to it, but the value to an attacker is control of the telephony infrastructure itself: call routing, voicemail, toll fraud, and a foothold on a system that admins rarely patch or monitor. Because the OmniPCX web interface is administrative and not something end users need, exposure of masterCGI to any untrusted network is the core risk, not the age of the CVE.
Do this: Confirm whether the OmniPCX Enterprise management web interface hosting masterCGI is reachable from user VLANs or the internet, and remove that exposure first by restricting it to a dedicated management network or admin jump host. Apply the Alcatel fixed release for the Unified Maintenance Tool; if your version is out of support and no patch exists, treat network isolation and access control lists in front of the CGI as the primary control. Review call server logs and web request logs for unexpected masterCGI requests containing shell characters, and check for unexplained accounts, cron entries, or outbound connections on the call server, since a system exploited before you isolated it will not clean itself. Because CISA lists it as actively exploited, prioritize this above routine PBX maintenance rather than deferring it as legacy.
- NIST NVD / Tenable entry for CVE-2007-3010: Primary technical record of the masterCGI command execution flaw with the CVSS scoring, used to describe exactly what is vulnerable.
- CISA Known Exploited Vulnerabilities Catalog: Authoritative confirmation that the flaw is actively exploited, with the 2022-04-15 addition date that justifies prioritizing it.
- Pentest-Tools: Alcatel-Lucent OmniPCX Remote Command Execution (CVE-2007-3010): Recently updated analyst and exploit reference (2024) showing the vulnerability is still tracked and testable in current tooling.
AI-generated from public data, 2026-07-22. Verify against the vendor advisory before acting.
Senserva AI Opinion and rich prompt for CVE-2007-3010
Copy this prompt into Claude, ChatGPT, or Copilot. The facts are included, sourced from this page.
Full tracking and change history for CVE-2007-3010
Published and last-revised dates are authoritative, from Microsoft MSRC (or the CISA KEV date-added). Senserva additionally records day-to-day changes from 2026-07-07, refreshed several times a day; the change count reflects that forward-only tracking.
CISA required action
Federal (BOD 22-01) remediation due date: 2022-05-06 (past due).
Apply updates per vendor instructions.
Official fix for CVE-2007-3010
Check the vendor's security advisory channel for the patched OmniPCX Enterprise versions and workarounds.
Common questions about CVE-2007-3010
Is CVE-2007-3010 actively exploited?
Yes. CVE-2007-3010 was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2022-04-15, which means exploitation in the wild has been confirmed, not predicted. Its EPSS 30-day exploitation probability is 98%.
What is the CISA deadline and required action for CVE-2007-3010?
CISA set the federal (BOD 22-01) remediation due date at 2022-05-06, which has passed; treat any unremediated system as overdue. The verbatim required action: Apply updates per vendor instructions.
What fixes CVE-2007-3010?
Check the vendor's security advisory for the patched OmniPCX Enterprise versions and any workarounds. KEV listing makes this a fix-first item: patch it ahead of higher-CVSS issues nobody is exploiting.
Can I ask my own AI about CVE-2007-3010?
Yes. This page includes a free, ready-to-paste AI prompt containing CVE-2007-3010's key facts: severity, CVSS, EPSS, the KEV date, the CISA due date, and the required action. Copy it into Claude, ChatGPT, or Copilot; the data is refreshed twice a day (5 AM and 3 PM US Central).
Authoritative references
Every actively exploited CVE, searchable with due dates and CSV export: the exploited-CVE tracker. The newest additions: exploited this week.
