CVE-2024-33109

9.8 criticalEPSS 0.9%

Critical (9.8). EPSS 0.9% chance of exploitation in the next 30 days.

Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via the Ringtone upload function.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2024-09-19
Modified: 2026-07-05
Record from: the NVD, synced 2026-10-19

Affected

ergophone:tiptel_ip_286_firmware
yealink:sip-t28p_firmware

References

https://www.bdosecurity.de/en-gb/advisories/cve-2024-33109

Check your stack JSON