HIGH🇵🇱 Wersja polska

CVE-2019-12612

CVSS 7.8v3.1pub. 2019-10-31upd. 2024-11-21

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup mode.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Bitdefender Box

    HW
    Bitdefender
    wszystkie wersje

  • Bitdefender Box Firmware

    OS
    Bitdefender
    < 2.1.37.37-34
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2024-13871CRITICAL9.4PL ✓ten sam produkt

Command injection w Bitdefender Box 1 — nieuwierzytelniony RCE

CVE-2024-13872CRITICAL9.4PL ✓ten sam produkt

Niezabezpieczony mechanizm aktualizacji w Bitdefender Box — RCE przez MITM

CVE-2019-12611MEDIUM4.4ten sam produkt

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reli...

CVE-2024-13870LOW1.8ten sam produkt

An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) t...

CVE-2025-1987CRITICAL9.3PL ✓ten sam vendor

Stored XSS w Psono Client / Bitdefender SecurePass via złośliwe URL w magazynie haseł