CVE-2024-13870

Description

An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.

Reserved 2025-02-13 | Published 2025-03-12 | Updated 2025-03-12 | Assigner Bitdefender

Problem types

CWE-1328: Security Version Number Mutable to Older Versions

Product status

Default status
unaffected

Any version
affected

Credits

Bitdefender Labs finder

References

bitdefender.com/...-firmware-downgrade-in-bitdefender-box-v1

cve.org (CVE-2024-13870)

nvd.nist.gov (CVE-2024-13870)

Download JSON