CVE-2024-29149: Alcatel-Lucent Ale 20

High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days.

An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. Because of a time-of-check time-of-use vulnerability, an authenticated attacker is able to replace the verified firmware image with malicious firmware during the update process.

Affected products

• Alcatel-Lucent Ale 20: affected versions not specified
• Alcatel-Lucent Ale 20h: affected versions not specified
• Alcatel-Lucent Ale 30: affected versions not specified
• Alcatel-Lucent Ale 300: affected versions not specified
• Alcatel-Lucent Ale 30h: affected versions not specified
• Alcatel-Lucent Ale 400: affected versions not specified
• Alcatel-Lucent Ale 500: affected versions not specified

Published 2024-05-07. Last modified 2026-06-17.