CVE-2019-12611: bitdefender box_firmware

Vulnerability summary

CVE-2019-12611 is a medium (CVSS 4.9) vulnerability in bitdefender box_firmware. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities.

Timeline

1. 17-10-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the miniupnpd component to crash or to trigger a device reboot.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.