Unauthenticated Firmware Downgrade in Bitdefender Box v1
Priority LOW 9CWE-1328Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00166 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bitdefender | BOX v1 | up to 1.3.52.928 | — | No fix listed | CNA |
- BOX v1 VendorBitdefender Affected up to 1.3.52.928 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:bitdefender:box_firmware:*:*:*:*:*:*:*:* | up to 1.3.52.928 | Vulnerable | Bitdefender |
| cpe:2.3:h:bitdefender:box:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Bitdefender |
- cpe:2.3:o:bitdefender:box_firmware:*:*:*:*:*:*:*:* Versions up to 1.3.52.928 Vulnerable ·Bitdefender
- cpe:2.3:h:bitdefender:box:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Bitdefender
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-13870
- 2026-10-03 Alias added: GHSA-8wpx-wqvh-rxw6
References
More Bitdefender Box Firmware vulnerabilities
- TI-2024-12892 Unauthenticated Command Injection in Bitdefender BOX v1 CVSS 4.0CRITICAL 9.4
- TI-2024-12893 Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.so CVSS 4.0CRITICAL 9.4
- TI-2019-09414 An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that… CVSS 3.1HIGH 7.8
- TI-2019-09413 An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that… CVSS 3.1MEDIUM 4.4
Sources
- CVE-2024-13870 · CVE Program
- CVE-2024-13870 · NVD
- FIRST EPSS
- GHSA-8wpx-wqvh-rxw6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences