CVE-2007-3010

Senserva AI Opinion for CVE-2007-3010

CVE-2007-3010 is a command injection flaw in the masterCGI component of the Unified Maintenance Tool that ships with Alcatel OmniPCX Enterprise Communication Server. An unauthenticated remote attacker can reach masterCGI over the maintenance web interface and inject operating system commands, which run with the privileges of the CGI process on the call server. This is not a memory corruption bug that needs an exploit chain. It is direct command execution through a maintenance script, so a single crafted HTTP request is enough. The report is dated 2007, but CISA added it to the Known Exploited Vulnerabilities catalog on 2022-04-15, meaning it was still being used against exposed systems fifteen years after disclosure. The EPSS score of 97 percent reflects that working exploit code is public and easy to run. The real exposure here is specific to OmniPCX: this is telephony infrastructure, so a compromise gives an attacker a foothold on the voice call server rather than a generic web host, and these appliances are often left on flat management networks and forgotten during patch cycles. There is no reported ransomware association, but command execution as the CGI user is a stepping stone to fuller control of the PBX.

Do this: Confirm whether any Alcatel OmniPCX Enterprise Communication Server in your estate exposes the Unified Maintenance Tool or its masterCGI interface, then apply the Alcatel vendor patch for this specific defect. If a patch cannot be applied immediately, block reachability to the maintenance web interface from untrusted networks and restrict it to a dedicated management segment or jump host. Because this is on the CISA KEV list, US federal agencies were required to remediate it, and any organization should treat internet or LAN exposure of this interface as an active incident risk, not a theoretical one. Review call server logs for unexpected commands run by the CGI process and for outbound connections from the PBX.

AI-generated from public data, 2026-07-26. Verify against the vendor advisory before acting.

Full tracking and change history for CVE-2007-3010

Published

2022-04-15

Last revised

2022-04-15

Changes tracked

1

Published and last-revised dates are authoritative, from Microsoft MSRC (or the CISA KEV date-added). Senserva additionally records day-to-day changes from 2026-07-07, refreshed several times a day; the change count reflects that forward-only tracking.

CISA required action

Federal (BOD 22-01) remediation due date: 2022-05-06 (past due).

Apply updates per vendor instructions.

Common questions about CVE-2007-3010

Is CVE-2007-3010 actively exploited?

Yes. CVE-2007-3010 was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2022-04-15, which means exploitation in the wild has been confirmed, not predicted. Its EPSS 30-day exploitation probability is 97%.

What is the CISA deadline and required action for CVE-2007-3010?

CISA set the federal (BOD 22-01) remediation due date at 2022-05-06, which has passed; treat any unremediated system as overdue. The verbatim required action: Apply updates per vendor instructions.

What fixes CVE-2007-3010?

Check the vendor's security advisory for the patched OmniPCX Enterprise versions and any workarounds. KEV listing makes this a fix-first item: patch it ahead of higher-CVSS issues nobody is exploiting.

Can I ask my own AI about CVE-2007-3010?

Yes. This page includes a free, ready-to-paste AI prompt containing CVE-2007-3010's key facts: severity, CVSS, EPSS, the KEV date, the CISA due date, and the required action. Copy it into Claude, ChatGPT, or Copilot; the data is refreshed twice a day (5 AM and 3 PM US Central).

Scope and sources

Authoritative references

CVE recordNVD detailCISA KEV catalogFIRST.org EPSS