Security Advisory

CVE-2019-17102

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2020-01-27 14:05:23

Last updated 2024-09-17 03:59:40

Assigner Bitdefender

State PUBLISHED

Description

An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of system commands. This issue affects: Bitdefender Bitdefender BOX 2 versions prior to 2.1.47.36.

← Browse all CVEs View on cve.org ↗