CVE-2024-13871
Unauthenticated Command Injection in Bitdefender BOX v1
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Unauthenticated Command Injection in Bitdefender BOX v1
A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE).
Reserved 2025-02-13 | Published 2025-03-12 | Updated 2025-03-12 | Assigner BitdefenderCWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Bitdefender Labs
bitdefender.com/...d-command-injection-in-bitdefender-box-v1
Support options
