CM7 user here. Can confirm that it is vulnerable. Easily fixed by installing a second dialer so that you'll always get a prompt. Also I can't find any info on whether cm7 supports USSD factory reset. Anybody aware?