LOW🇬🇧 English

CVE-2024-13870

CVSS 1.8v4.0pub. 2025-03-12upd. 2025-07-30

An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.

oryginał EN
CVSS Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X

  • Bitdefender Box

    HW
    Bitdefender
    wszystkie wersje

  • Bitdefender Box Firmware

    OS
    Bitdefender
    ≤ 1.3.52.928
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Referencje

Powiązane podatności

CVE-2024-13871CRITICAL9.4PL ✓ten sam produkt

Command injection w Bitdefender Box 1 — nieuwierzytelniony RCE

CVE-2024-13872CRITICAL9.4PL ✓ten sam produkt

Niezabezpieczony mechanizm aktualizacji w Bitdefender Box — RCE przez MITM

CVE-2019-12612HIGH7.8ten sam produkt

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pa...

CVE-2019-12611MEDIUM4.4ten sam produkt

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reli...

CVE-2025-1987CRITICAL9.3PL ✓ten sam vendor

Stored XSS w Psono Client / Bitdefender SecurePass via złośliwe URL w magazynie haseł