CVE-2019-17102

Summary

An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/update_setup does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of system commands. This issue affects: Bitdefender Bitdefender BOX 2 versions prior to 2.1.47.36.

Affected Software

VendorProductVersion RangeStatus
BitdefenderBitdefender BOX 2unspecified < 2.1.47.36affected

Weaknesses

  • CWE-413: CWE-413: Improper Resource Locking

ADP Enrichment

CVE Program Container

Additional References

References