A
n issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. Because of a time-of-check time-of-use vulnerability, an authenticated attacker is able to replace the verified firmware image with malicious firmware during the update process.
References
Configurations
No configuration.
History
21 Nov 2024, 09:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.al-enterprise.com/-/media/assets/internet/documents/n-to-s/sa-c0071-ed01.pdf - | |
| References | () https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-010.txt - |
03 Jul 2024, 01:52
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-367 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.4 |
07 May 2024, 20:07
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-05-07 17:15
Updated : 2024-11-21 09:07
NVD link : CVE-2024-29149
Mitre link : CVE-2024-29149
CVE.ORG link : CVE-2024-29149
JSON object : View
Products Affected
No product.
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition