PT-2019-12890 · Bitdefender · Bitdefender Box

Published 2019-10-31 · Updated 2020-08-24 · CVE-2019-12612

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bitdefender BOX versions prior to 2.1.37.37-34

Description An issue was discovered that allows an attacker to pass arbitrary code to the BOX appliance via the web API. To exploit this, an attacker needs presence in the Bitdefender BOX setup network and the BOX must be in setup mode.

Recommendations For versions prior to 2.1.37.37-34, update to version 2.1.37.37-34 or later to resolve the issue. As a temporary workaround, consider restricting access to the web API until a patch is applied.

Fix

Related Identifiers

CVE-2019-12612

Affected Products

Bitdefender Box

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-12612 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12612 · Vendor Advisory
• https://bitdefender.com/support/security-advisories/bitdefender-box-local-code-execution · Vendor Advisory