CVE-2024-13870
Bitdefender Box Firmware ≤ 1.3.52.928
Raw vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-13870 is a low-severity Security Version Number Mutable to Older Versions (CWE-1328) vulnerability in Bitdefender Box Firmware. Its CVSS base score is 1.8 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-51 (Hardware-based Protection) and SI-7 (Software, Firmware, and Information Integrity) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54187
Vulnerability Data
An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmware. The attack requires Bitdefender BOX…
more
to be booted in Recovery Mode and that the attacker be present within the WiFi range of the BOX unit.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Hardware-enforced write protection directly stops unauthorized mutation of a security version number to older values.
Firmware integrity verification can discover that a version rollback has occurred after the fact.
Enforcing access restrictions on configuration changes can block unauthorized writes to a mutable security version register.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Pre-acquisition assessment of hardware authenticity/integrity directly prevents purchase of chips whose security version numbers can be rolled back.
Hardened baselines and configuration management can enforce immutable version checks or secure-boot policies that mitigate rollback.
Hardware lacking immutable version-number protection can be identified and replaced as part of risk-based hardware maintenance.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Controlled software installation procedures can block unauthorized or older firmware versions from being loaded.
A.8.25 requires secure SDLC practices including secure coding, version control, and testing but does not stop a mutable security version number from allowing firmware rollback to vulnerable code; the hardware weakness can still be exploited.
A.8.27 mandates establishing and applying secure engineering principles (including least privilege, security by design, defense in depth, hardening, and zero-trust verification) during the development life cycle; it does not stop an already-mutable security version number from being exploited via rollback to vulnerable firmware.
Change-management processes can require cryptographic verification of firmware versions before deployment.