CVE-2019-17096 Bitdefender BOX 2 bootstrap get_image_size command injection vulnerability
An attacker can inject system commands via the bootstrap stage of Bitdefender BOX 2, potentially leading to remote code execution on the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-17096?
CVE-2019-17096 is a critical command injection vulnerability in Bitdefender BOX 2, published on 28 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumstances to inject a system command.
Weakness: CWE-78
Which versions are affected by CVE-2019-17096?
It affects 2 products.
Products include Bitdefender Box 2 Firmware, Bitdefender Central.
How do I fix CVE-2019-17096?
No fix has been published for CVE-2019-17096 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-17096 being exploited?
There is no known exploitation of CVE-2019-17096 in the wild and no public exploit code.
Other vulnerabilities in Bitdefender BOX 2
Sources
Also known as GHSA-xj7c-f2c8-xgv2.