CVE-2024-33109: Path Traversal
Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via the Ringtone upload function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tiptel IP 286 firmwareto a version that resolves this vulnerability.Fixed in 2.61.13.10 - Compensating control
Mitigate by restricting or blocking access to the phone web interface and the Ringtone upload function to prevent exploitation of the directory traversal that allows overwriting arbitrary files.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-33109?
CVE-2024-33109 is classified as a critical vulnerability due to its potential to allow attackers to overwrite arbitrary files.
How do I fix CVE-2024-33109?
To fix CVE-2024-33109, it is recommended to update the Tiptel IP 286 firmware to a version later than 2.61.13.10.
Which devices are affected by CVE-2024-33109?
CVE-2024-33109 affects devices using Tiptel IP 286 firmware version 2.61.13.10 or earlier.
What impact can CVE-2024-33109 have on users?
Exploitation of CVE-2024-33109 can lead to unauthorized file overwriting, potentially compromising the device's functionality.
Is there a workaround for CVE-2024-33109 until a patch is available?
Currently, there are no known workarounds for CVE-2024-33109 other than applying the firmware update.