← CVE Intelligence

CVE-2024-13870

Unauthenticated Firmware Downgrade in Bitdefender Box v1 PUBLISHED

Description (CNA)

An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.

Affected (CNA)

Vendor / productVersions
Bitdefender / BOX v1affected 0 through 1.3.52.928

CWE

CWE-1328

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.