Bitdefender Box 1 Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the Bitdefender Box 1, specifically in firmware version 1.3.11.490. The vulnerability resides in the '/check_image_and_trigger_recovery' API endpoint, where an unauthenticated, network-adjacent attacker can execute arbitrary commands on the device. This exploitation could potentially lead to full remote code execution.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device, with the potential for full remote code execution.

Remediation

Users can update to Bitdefender Box firmware version 1.3.11.510 to address this vulnerability.