← Back

CVE-2024-13870

nvd nist
Published: Mar 12, 2025Modified: Jun 17, 2026

JSON object

Loading...
1.8
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:XShow less
Source: cve-requests@bitdefender.com (Secondary)

Description

An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.

Affected (1)

Bitdefender
1 product
Box Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Box Firmware
Up to 1.3.52.928
Running on/withPlatform Versions
Bitdefender
Box
All versions

Related CWEs

CWE-1328
Security Version Number Mutable to Older Versions
Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.

References (1)

Source: cve-requests@bitdefender.com
Vendor Advisory

Timeline

No history available yet.