CVE-2019-17095

A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method `/api/download_image` unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands. In order to exploit the condition, an unauthenticated attacker should impersonate a infrastructure server to trigger this vulnerability.

• CWE-78
• CWE-78

• https://www.bitdefender.com/support/security-advisories/command-injection-vulnerability-in-bitdefender-box-v2-va-5706Broken Link
• https://talosintelligence.com/vulnerability_reports/TALOS-2019-0919Exploit, Third Party Advisory
• https://www.cybersecurity-help.cz/vdb/SB2020012215?affChecked=1Third Party Advisory
• https://www.bitdefender.com/support/security-advisories/command-injection-vulnerability-in-bitdefender-box-v2-va-5706Broken Link

Published

Jan 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-17087Unauthorized file download vulnerability in all supported ve…7.5
• CVE-2019-1709A vulnerability in the CLI of Cisco Firepower Threat Defense…7.8
• CVE-2019-17091faces/context/PartialViewContextImpl.java in Eclipse Mojarra…6.1
• CVE-2019-17092An XSS vulnerability in project list in OpenProject before 9…6.1
• CVE-2019-17093An issue was discovered in Avast antivirus before 19.8 and A…7.8
• CVE-2019-17094A Stack-based Buffer Overflow vulnerability in libbelkin_api…7.8
• CVE-2019-17096A OS Command Injection vulnerability in the bootstrap stage …9.8
• CVE-2019-17098Use of hard-coded cryptographic key vulnerability in August …6.5
• CVE-2019-17099An Untrusted Search Path vulnerability in EPSecurityService.…7.8
• CVE-2019-1710A vulnerability in the sysadmin virtual machine (VM) on Cisc…9.8
• CVE-2019-17100An Untrusted Search Path vulnerability in bdserviceshost.exe…6.5
• CVE-2019-17101Improper Neutralization of Special Elements used in a Comman…6.7