CVE-2024-13870: Bitdefender Box Firmware

Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days.

An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.

Affected products

• Bitdefender Box Firmware: up to and including 1.3.52.928

Published 2025-03-12. Last modified 2026-06-17.