CVE-2019-17096: Bitdefender BOX 2 bootstrap get_image_size command injection vulnerability
First published: Mon Mar 11 2019(Updated: )
A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumstances to inject a system command.
Credit: cve-requests@bitdefender.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bitdefender Box 2 Firmware | ||
| Bitdefender BOX 2 | ||
| Bitdefender Central | <2.0.66 | |
| Bitdefender Central | <2.0.66.88 |
Remedy
An update that mitigates the issue has been delivered in: Bitdefender Central Android App version 2.0.66.88 Bitdefender Central iOS App version 2.0.66
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-17096?
CVE-2019-17096 is an OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2.
How does CVE-2019-17096 affect Bitdefender BOX 2?
CVE-2019-17096 allows the manipulation of the `get_image_url()` function in special circumstances to inject a system command.
What is the severity of CVE-2019-17096?
CVE-2019-17096 has a severity rating of 9.8 (Critical).
How can I fix CVE-2019-17096?
To fix CVE-2019-17096, update to the latest version of Bitdefender BOX 2 firmware.
Where can I find more information about CVE-2019-17096?
You can find more information about CVE-2019-17096 at the following link: [https://www.bitdefender.com/support/security-advisories/bitdefender-box-2-bootstrap-get_image_size-command-injection-vulnerability/](https://www.bitdefender.com/support/security-advisories/bitdefender-box-2-bootstrap-get_image_size-command-injection-vulnerability/)
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/title
- agent/remedy
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/tags
- vendor/bitdefender
- canonical/bitdefender box 2 firmware
- canonical/bitdefender box 2
- canonical/bitdefender central