CVE-2007-5361: Alcatel-Lucent OmniPCX

High severity, CVSS 8.5. EPSS: 2.4% chance of exploitation in the next 30 days.

The Communication Server in Alcatel-Lucent OmniPCX Enterprise 7.1 and earlier caches an IP address during a TFTP request from an IP Touch phone, and uses this IP address as the destination for all subsequent VoIP packets to this phone, which allows remote attackers to cause a denial of service (loss of audio) or intercept voice communications via a crafted TFTP request containing the phone's MAC address in the filename.

Affected products

• Alcatel-Lucent OmniPCX: up to and including 7.1

Published 2007-11-20. Last modified 2026-06-16.