CVE-2019-17102: bitdefender bitdefender box 2 Improper Resource Locking
Vulnerability summary
CVE-2019-17102 is a high (CVSS 9.3) Improper Resource Locking vulnerability in bitdefender bitdefender box 2. EPSS estimates a 1.95% chance of exploitation in the next 30 days, higher than 79.9% of scored vulnerabilities.
Timeline
- 27-01-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU) that allows arbitrary execution of system commands. This issue affects: Bitdefender Bitdefender BOX 2 versions prior to 2.1.47.36.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.95%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.95% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-413Improper Resource LockingThe product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
- CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Affected systems
Bitdefender2 products
- bitdefender box 2≥ unspecified, < 2.1.47.36
- box_2_firmware< 2.1.47.36
1 vendor · 2 products