PT-2025-11032 · Bitdefender · Bitdefender Box

Bitdefender Labs

·

Publicado

2025-03-12

·

Atualizado

2025-07-30

·

CVE-2024-13871

CVSS v4.0

9.4

Crítica

VetorAV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Name of the Vulnerable Software and Affected Versions: Bitdefender Box 1 version 1.3.11.490
Description: A command injection vulnerability exists in the "/check image and trigger recovery" API endpoint, allowing an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE).
Recommendations: For Bitdefender Box 1 version 1.3.11.490, as a temporary workaround, consider disabling access to the "/check image and trigger recovery" API endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2025-03183
CVE-2024-13871

Produtos afetados

Bitdefender Box