← CVE Intelligence

CVE-2024-13871

Unauthenticated Command Injection in Bitdefender BOX v1 PUBLISHED

Description (CNA)

A command injection vulnerability exists in the /check_image_and_trigger_recovery API endpoint of Bitdefender Box 1 (firmware version 1.3.11.490). This flaw allows an unauthenticated, network-adjacent attacker to execute arbitrary commands on the device, potentially leading to full remote code execution (RCE).

Affected (CNA)

Vendor / productVersions
Bitdefender / BOX v1affected 1.3.11.490 before 1.3.11.505

CWE

CWE-77

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.