// For flags

CVE-2019-17102

Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of system commands. This issue affects: Bitdefender Bitdefender BOX 2 versions prior to 2.1.47.36.

Se presenta una vulnerabilidad de ejecución de comando explotable en la partición de recuperación de Bitdefender BOX 2, versión 2.0.1.91. El método "/api/update_setup" de la API no realiza comprobaciones de firma de firmware automáticamente, lo que conlleva a una condición de carrera explotable (TOCTTOU) lo que permite una ejecución arbitraria de comandos de sistema. Este problema afecta a: Bitdefender Bitdefender BOX 2 versiones anteriores versiones hasta 2.1.47.36.

*Credits: Bugcrowd user Mongo
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-10-02 CVE Reserved
  • 2020-01-27 CVE Published
  • 2023-06-01 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-413: Improper Resource Locking
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Bitdefender
Search vendor "Bitdefender"
 Box 2 Firmware
Search vendor "Bitdefender" for product "Box 2 Firmware"
 < 2.1.47.36
Search vendor "Bitdefender" for product "Box 2 Firmware" and version " < 2.1.47.36"
-
Affected
in Bitdefender
Search vendor "Bitdefender"
 Box 2
Search vendor "Bitdefender" for product "Box 2"
--
Safe