9.8Crítica
KEV
CVE-2007-3010Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
Explotación conocida — Alcatel OmniPCX Enterprise Remote Code Execution Vulnerability
CISA confirmó el 15.04.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 06.05.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2007-3010
Descripción
masterCGI in the Unified Maintenance Tool in Alcatel OmniPCX Enterprise Communication Server R7.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the user parameter during a ping action.
Debilidad (CWE):
CWE-77
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| al-enterprise | omnipcx enterprise communication server | ≤ 7.1 |
Referencias y parches
- ADV-2007-3185 vdb-entryBroken Link
- http://www.redteam-pentesting.de/advisories/rt-sa-2007-001.php Broken Link
- http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm Broken Link
- 26853 third-party-advisoryBroken LinkVendor Advisory
- 20070917 Alcatel-Lucent OmniPCX Remote Command Execution mailing-listExploitMailing List
- 40521 vdb-entryBroken Link
- 20070917 Alcatel-Lucent OmniPCX Remote Command Execution mailing-listBroken LinkThird Party AdvisoryVDB Entry
- alcatel-unified-mastercgi-command-execution(36632) vdb-entryThird Party AdvisoryVDB Entry
- 25694 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2007-3010 US Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:a:al-enterprise:omnipcx_enterprise_communication_server:*:*:*:*:*:*:*:*≤ 7.1