CVE-2019-17095: Bitdefender BOX 2 bootstrap download_image command injection vulnerability

Published Jan 27, 2020

Updated

A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method /api/downloadimage unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands. In order to exploit the condition, an unauthenticated attacker should impersonate a infrastructure server to trigger this vulnerability.

Affected Software

3 affected components

Bitdefender Box 2 Firmware=2.1.47.42

Bitdefender Box 2 Firmware=2.1.53.45

Bitdefender BOX 2

Remediation

Information

An update that mitigates the issue has been delivered in: Bitdefender Central Android App version 2.0.66.88 Bitdefender Central iOS App version 2.0.66

Event History

Jan 27, 2020

CVE Published

via MITRE·05:20 PM

Data Sourced

via MITRE·05:20 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2019-17095?

CVE-2019-17095 is a command injection vulnerability in Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45.

How severe is CVE-2019-17095?

CVE-2019-17095 has a severity rating of 9.8 (Critical).

Which software versions are affected by CVE-2019-17095?

Bitdefender BOX 2 firmware versions 2.1.47.42 and 2.1.53.45 are affected by CVE-2019-17095.

How does CVE-2019-17095 work?

CVE-2019-17095 allows remote attackers to execute arbitrary system commands by supplying a malicious firmware URL through the `/api/download_image` API method.

Is there a fix available for CVE-2019-17095?

Yes, Bitdefender has released a security advisory with instructions on how to apply the necessary updates to fix CVE-2019-17095.