Design/Logic Flaw

An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69...

CVE-2019-17103 Get-task-allow entitlement via BDLDaemon on macOS

An Incorrect Default Permissions vulnerability in the BDLDaemon component of Bitdefender AV for Mac allows an attacker to elevate permissions to read protected directories. This issue affects: Bitdefender AV for Mac versions prior to 8.0.0...

CVE-2019-17103

CVE-2019-17103 concerns an Incorrect Default Permissions issue in the BDLDaemon component of Bitdefender AV for Mac, enabling an attacker to elevate privileges to read protected directories. Affected software: Bitdefender AV for Mac, prior to version 8.0.0. Root cause: incorrect default permissio...

CVE-2019-17102 Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)

An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method /api/updatesetup does not perform firmware signature checks atomically, leading to an exploitable race condition TOCTTOU that allows arbitrary execution of system...

CVE-2019-17102

The CVE-2019-17102 issue affects Bitdefender BOX 2 bootstrapping. A TOCTTOU race condition arises in the update_setup flow: POST requests to /api/update_setup acquire an atomic lock, but the parallel forked update_setup runs install_full_ws after extracting a signed full_ws.tar.gz. An attacker ca...

CVE-2019-17100 Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)

An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69...

CVE-2019-17100

The CVE-2019-17100 entry describes an Untrusted Search Path vulnerability in bdserviceshost.exe used by Bitdefender Total Security 2020 . The issue could allow an attacker to execute arbitrary code, via a local attack vector, on affected installations. The vulnerability does not affect Bitdefende...

Vulnerability Spotlight: Bitdefender BOX 2 bootstrap remote code execution vulnerabilities

Claudio Bozzato, Lilith Wyatt and Dave McDaniel of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. The Bitdefender BOX 2 contains two remote code execution vulnerabilities in its bootstrap stage. The BOX 2 is a device that protects users’ home networks from a variety of threats...

Bitdefender Command Injection Vulnerability

BitDefender is a world-renowned antivirus program. Bitdefender has a command injection vulnerability that can be exploited by an attacker to execute system commands by mimicking an infrastructure server...

Amazon Fixes Ring Video Doorbell Flaw That Leaked Wi-Fi Credentials

UPDATE Amazon has patched a vulnerability in its Ring smart doorbell device that could allow attackers to access the owner’s Wi-Fi network credentials and potentially reconfigure the device to launch an attack on the home network, researchers have found. Researchers discovered the problem in...

CVE-2019-12612

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup...

CVE-2019-12612

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup...

Design/Logic Flaw

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup...

CVE-2019-12612

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitrary code to the BOX appliance via the web API. In order to exploit this vulnerability, an attacker needs presence in Bitdefender BOX setup network and Bitdefender BOX be in setup...

CVE-2019-12612

CVE-2019-12612 affects Bitdefender BOX firmware versions before 2.1.37.37-34. The issue allows an attacker to pass arbitrary code to the BOX appliance via the web API, requiring the attacker to be present on the Box setup network and for the BOX to be in setup mode. The connected records provide ...

CVE-2019-12611

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the...

CVE-2019-12611

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the...

Information disclosure

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the...

CVE-2019-12611

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the...

CVE-2019-12611

Bitdefender BOX firmware pre-2.1.37.37-34 is affected. The vulnerability lies in the miniupnpd implementation where specially crafted packets trigger memory allocation that is not freed, potentially causing the miniupnpd component to crash or the device to reboot. Impact is described as availabil...