CVE-2024-29149

—

CVSS 3.1

7.4 high

EPSS

<1%p10

Published

May 7, 2024 (May 7, 2024)

Modified

Jun 17, 2026

Description

An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. Because of a time-of-check time-of-use vulnerability, an authenticated attacker is able to replace the verified firmware image with malicious firmware during the update process.

Weakness: CWE-367
Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.