High severity · published Oct 31, 2019
CVE-2019-12612
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup mode.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Box Firmware · Bitdefender
before 2.1.37.37-34 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12612
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12612
Vendor Advisory
https://www.bitdefender.com/support/security-advisories/bitdefender-box-local-code-execution/
More from Box Firmware
8.8
CVE-2024-13871
Unauthenticated Command Injection in Bitdefender BOX v1
7.5
CVE-2024-13872
Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.so
5.7
CVE-2024-13870
Unauthenticated Firmware Downgrade in Bitdefender Box v1
4.4
CVE-2019-12611
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product