1. CVE-Search
  2. CVE-2019-12612
ID CVE-2019-12612
Summary An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup mode.
References
Vulnerable Configurations
  • cpe:2.3:o:bitdefender:box_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:bitdefender:box_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:h:bitdefender:box:-:*:*:*:*:*:*:*
    cpe:2.3:h:bitdefender:box:-:*:*:*:*:*:*:*
CVSS
Base: 7.2 (as of 24-08-2020 - 17:37)
Impact:
Exploitability:
CWE NVD-CWE-noinfo
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:L/AC:L/Au:N/C:C/I:C/A:C
refmap via4
confirm https://www.bitdefender.com/support/security-advisories/bitdefender-box-local-code-execution/
Last major update 24-08-2020 - 17:37
Published 31-10-2019 - 17:15
Last modified 24-08-2020 - 17:37
Back to Top