CVE-2024-13870
An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.
Scoring
- Severity
- LOW
- CVSS base score
- 1.8
- CVSS vector
- CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:N
- EPSS probability
- 0.16%
- CWE
- CWE-1328
- Published
- 2025-03-12
- Last modified
- 2026-03-13
Affected products
- Bitdefender BOX v1
Weakness type
Related vulnerabilities
- CVE-2025-8321 — Tesla Wall Connector Firmware Downgrade Vulnerability
- CVE-2025-5825 — Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability
- CVE-2025-29989 — Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions...
- CVE-2023-50738 — A firmware downgrade prevention vulnerability has been identified in newer Lexmark devices.