1. Home
  2. CVE Database
  3. CVE-2024-13870
MEDIUM · 5.7

CVE-2024-13870

An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, pot...

Vulnerability Description

An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.

CVSS Score

5.7

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
BitdefenderBox Firmware<= 1.3.52.928
BitdefenderBox-

Related Weaknesses (CWE)

CWE-1328

References

FAQ

What is CVE-2024-13870?

CVE-2024-13870 is a vulnerability with a CVSS score of 5.7 (MEDIUM). An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, pot...

How severe is CVE-2024-13870?

CVE-2024-13870 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-13870?

Check the references section above for vendor advisories and patch information. Affected products include: Bitdefender Box Firmware, Bitdefender Box.