CVE-2007-3010

Think of the Unified Maintenance Tool like a built-in “diagnostic button” used to test network connectivity. Due to a flaw, an attacker can press that button in a sneaky way—without needing an account—and make the server run commands on the underlying computer instead of just performing the test. For a business, that can mean attackers taking over the server and using it as a launch point for further damage.

This matters if you use or host an Alcatel OmniPCX Enterprise Communication Server running version R7.1 or earlier. The key risk is that the vulnerable tool can be reached over the network in default configuration and does not require a login, so any exposed access path increases danger. Treat it as relevant if the affected maintenance function is reachable from untrusted networks (commonly the internet).

This is actively exploited in the wild, and it is also listed in CISA’s Known Exploited Vulnerabilities—so it’s not just theoretical. Because it requires no login and is reachable in default configuration, attackers can target systems directly over the network, making this a RED, urgent remediation.

1. Confirm exposure and version

   • Identify the exact software version of the Alcatel OmniPCX Enterprise Communication Server.
   • Determine whether the Unified Maintenance Tool (“masterCGI”) is reachable from outside your trusted network (public internet, guest networks, peered networks).

2. Validate likely applicability

   • CVE-2007-3010 applies to OmniPCX Enterprise Communication Server R7.1 and earlier.
   • Confirm that the ping/maintenance functionality tied to the vulnerable tool is present and accessible.

3. Upgrade to the fixed vendor release

   • Apply vendor updates specifically addressing CVE-2007-3010 (“Apply updates per vendor instructions” per CISA KEV).
   • After upgrading, re-check the server’s version to confirm it is no longer R7.1 or earlier.

4. Immediate temporary containment if patching is delayed

   • Restrict network access to only trusted internal IPs/VPN users.
   • If the vendor provides a way to disable or limit access to the Unified Maintenance Tool/endpoint, do so until the update is applied.

5. Post-change checks (operational verification)

   • Confirm the maintenance/ping endpoint is no longer reachable from untrusted networks.
   • Review relevant device and application logs around the maintenance tool usage for unexpected requests (especially requests that resemble “ping” or diagnostic actions).

6. Timing note

   • CISA KEV listing includes a remediation due date of 2022-05-06; treat this as overdue and prioritize immediate patching and access restriction.

Severity is critical and the weakness is command injection (shell metacharacters) reachable over the network without authentication. Mechanism: “masterCGI” in the Unified Maintenance Tool allows the ping action to be manipulated so that a crafted request injects shell metacharacters via the user parameter, resulting in arbitrary operating system command execution. Exploitation status: listed in CISA KEV (added 2022-04-15) and exploitation is reported in the wild as part of the Evooo1Bot campaign active since July 2026 targeting publicly accessible devices. Impact aligns with full compromise potential (attacker-controlled command execution), which can lead to complete takeover and disruption. Exploit maturity is supported by KEV and reporting; EPSS is reported but not needed to drive urgency because real-world exploitation is confirmed by KEV/news.