PT-2024-22765 · Alcatel Lucent · Alcatel-Lucent Ale Noe Deskphones+1

Moritz Abrell · Published 2024-05-07 · Updated 2024-07-03 · CVE-2024-29149

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alcatel-Lucent ALE NOE deskphones versions 86x8 NOE-R300.1.40.12.4180 and earlier Alcatel-Lucent ALE SIP deskphones versions 86x8 SIP-R200.1.01.10.728 and earlier

Description An issue was discovered due to a time-of-check time-of-use vulnerability, allowing an authenticated attacker to replace the verified firmware image with malicious firmware during the update process.

Recommendations For Alcatel-Lucent ALE NOE deskphones versions 86x8 NOE-R300.1.40.12.4180 and earlier, update the firmware to a version later than 86x8 NOE-R300.1.40.12.4180. For Alcatel-Lucent ALE SIP deskphones versions 86x8 SIP-R200.1.01.10.728 and earlier, update the firmware to a version later than 86x8 SIP-R200.1.01.10.728. As a temporary workaround, consider restricting access to the firmware update process until a patch is available.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2024-29149

Affected Products

Alcatel-Lucent Ale Noe Deskphones

Alcatel-Lucent Ale Sip Deskphones

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-29149 · Security Note
• https://twitter.com/CVEnew/status/1787926426618052790 · Twitter Post
• https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-010.txt · Note
• https://twitter.com/VulmonFeeds/status/1787913057433194664 · Twitter Post
• https://al-enterprise.com/-/media/assets/internet/documents/n-to-s/sa-c0071-ed01.pdf · Note