PT-2025-11032 · Bitdefender · Bitdefender Box

Bitdefender Labs

·

Published

2025-03-12

·

Updated

2025-07-30

·

CVE-2024-13871

CVSS v4.0

9.4

Critical

VectorAV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Name of the Vulnerable Software and Affected Versions: Bitdefender Box 1 version 1.3.11.490
Description: A command injection vulnerability exists in the "/check image and trigger recovery" API endpoint, allowing an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE).
Recommendations: For Bitdefender Box 1 version 1.3.11.490, as a temporary workaround, consider disabling access to the "/check image and trigger recovery" API endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-03183
CVE-2024-13871

Affected Products

Bitdefender Box