CVE-2024-29149: High severity Alcatel-Lucent ALE NOE deskphones vulnerability
An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8NOE-R300.1.40.12.4180 and SIP deskphones through 86x8SIP-R200.1.01.10.728. Because of a time-of-check time-of-use vulnerability, an authenticated attacker is able to replace the verified firmware image with malicious firmware during the update process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29149?
CVE-2024-29149 is considered a high severity vulnerability due to the potential for authenticated attackers to replace firmware with malicious code.
How do I fix CVE-2024-29149?
To fix CVE-2024-29149, ensure that all affected Alcatel-Lucent ALE NOE and SIP deskphones are updated to the latest firmware version that addresses this vulnerability.
Who is affected by CVE-2024-29149?
CVE-2024-29149 affects users of Alcatel-Lucent ALE NOE deskphones and SIP deskphones running specific versions of firmware.
What type of attack can be executed due to CVE-2024-29149?
An attacker can exploit CVE-2024-29149 to replace verified firmware images with malicious firmware on affected deskphones.
Is user authentication required to exploit CVE-2024-29149?
Yes, an authenticated user must exploit CVE-2024-29149 to replace the firmware with a malicious version.