CVE-2019-17102 Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)
A race condition in the recovery partition allows attackers to bypass firmware signature checks and execute arbitrary system commands on Bitdefender BOX 2 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-17102?
CVE-2019-17102 is a high-severity vulnerability in Bitdefender BOX 2, published on 27 Jan 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of system commands. This issue affects: Bitdefender Bitdefender BOX 2 versions prior to 2.1.47.36.
Which versions are affected by CVE-2019-17102?
It affects 1 product.
Products include Bitdefender Box 2 Firmware.
How do I fix CVE-2019-17102?
No fix has been published for CVE-2019-17102 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-17102 being exploited?
There is no known exploitation of CVE-2019-17102 in the wild and no public exploit code.
Other vulnerabilities in Bitdefender BOX 2
Sources
Also known as GHSA-j5g5-24v2-cpf4.