Alcatel-Lucent.OmniPCX.Office.MasterCGI.User.Command.Execution
Description
This indicates an attack attempt against a command-injection vulnerability in Alcatel OmniPCX Office.
A vulnerability has been reported in Alcatel OmniPCX Office that may allow an attacker to execute shell commands on a vulnerable system. This is possible because the user input filters fail to properly sanitize the "user" parameter value that is passed to "MasterCGI". An attacker may include shell commands by supplying an injection string through the URL and a good string through POST or the COOKIE.
Affected Products
Alcatel-Lucent OmniPCX Enterprise 7.1
Alcatel-Lucent OmniPCX Enterprise 7.0
Alcatel-Lucent OmniPCX Enterprise 6.2
Alcatel-Lucent OmniPCX Enterprise 6.1
Alcatel-Lucent OmniPCX Enterprise 6.0
Alcatel-Lucent OmniPCX Enterprise 0
Alcatel-Lucent OmniPCX Enterpise 7
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Refer to the vendor's web site for the suggested workaround:
http://www.alcatel-lucent.com/security/psirt/statements/2007002/OXEUMT.htm
Telemetry
Coverage
IPS (Regular DB) | |
IPS (Extended DB) |
Version Updates
Date | Version | Detail |
---|---|---|
2020-06-29 | 15.875 | Sig Added |