Lucene search
MitreVULNRICHMENT:CVE-2024-29150HistoryMay 07, 2024 - 12:00 a.m.
CVE-2024-29150
2024-05-0700:00:00
mitre
github.com
6
alcatel-lucent
privilege management
symlink creation
unauthorized access
AI Score
6.8
Confidence
High
EPSS
0
Percentile
9.0%
SSVC
Exploitation
none
Automatable
no
Technical Impact
total
An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. Because of improper privilege management, an authenticated attacker is able to create symlinks to sensitive and protected data in locations that are used for debugging files. Given that the process of gathering debug logs is carried out with root privileges, any file referenced in the symlink is consequently written to the debug archive, thereby granting accessibility to the attacker.
ADP Affected
[
{
"cpes": [
"cpe:2.3:a:ALE_International:Alcatel-Lucent_ALE_DeskPhones:*:*:*:*:*:*:*:*"
],
"vendor": "ALE_International",
"product": "Alcatel-Lucent_ALE_DeskPhones",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "86x8_NOE-R300.1.40.12.4180",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "86x8_SIP-R200.1.01.10.728",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]Related
cve
cve
CVE-2024-29150
2024-05-07 17:15:07
cvelist
cvelist
CVE-2024-29150
2024-05-07 00:00:00
nvd
nvd
CVE-2024-29150
2024-05-07 17:15:07
AI Score
6.8
Confidence
High
EPSS
0
Percentile
9.0%
SSVC
Exploitation
none
Automatable
no
Technical Impact
total
Related for VULNRICHMENT:CVE-2024-29150