CVE-2007-3010

Think of the Unified Maintenance Tool like a built-in “diagnostic button” used to test network connectivity. Due to a flaw, an attacker can press that button in a sneaky way—without needing an account—and make the server run commands on the underlying computer instead of just performing the test. For a business, that can mean attackers taking over the server and using it as a launch point for further damage.

This matters if you use or host an Alcatel OmniPCX Enterprise Communication Server running version R7.1 or earlier. The key risk is that the vulnerable tool can be reached over the network in default configuration and does not require a login, so any exposed access path increases danger. Treat it as relevant if the affected maintenance function is reachable from untrusted networks (commonly the internet).

This is actively exploited in the wild, and it is also listed in CISA’s Known Exploited Vulnerabilities—so it’s not just theoretical. Because it requires no login and is reachable in default configuration, attackers can target systems directly over the network, making this a RED, urgent remediation.