Vulnerability Spotlight: Bitdefender BOX 2 bootstrap remote code execution vulnerabilities
Summary: Cisco Talos discovered two remote code execution vulnerabilities in the bootstrap stage of the Bitdefender BOX 2 home network security device. The flaws let an unauthenticated attacker execute arbitrary system commands: one through the `/api/download_image` method in versions 2.1.47.42 and 2.1.53.45 by impersonating a remote nimbus server, and another through a TOCTTOU race condition in `/api/update_setup` in version 2.0.1.91 triggered by a series of HTTP requests during bootstrap.
What's compelling: The device sold to protect home networks is the one an unauthenticated attacker can command, and the trigger is a spoofed server the box is built to trust.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026