This vulnerability specifically affects firmware version 1.3.11.490. The security flaw allows unauthenticated, network-adjacent attackers to execute arbitrary commands on the affected device. Bitdefender has disclosed two critical vulnerabilities affecting its BOX v1 device that could allow network-adjacent attackers to execute Man-in-the-Middle (MITM) attacks, potentially leading to remote code execution. The detailed CVSS vector string (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) indicates that the vulnerability requires adjacent network access but no privileges or user interaction, while enabling complete compromise of confidentiality, integrity, and availability. These security flaws impact a product that Bitdefender notes is no longer sold or supported, leaving users of legacy devices particularly vulnerable to exploitation. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Bitdefender Labs, the company’s internal security research team, discovered this vulnerability during routine security auditing procedures. The insecure update mechanism represents a fundamental security design flaw where sensitive operations occur without proper encryption or authentication safeguards. If continued use is necessary, implementing additional network security controls to isolate these devices and monitoring for suspicious network activity becomes essential defensive measures. However, no patch appears to be available for the insecure update mechanism vulnerability (CVE-2024-13872), as Bitdefender notes that the product is no longer supported. The second critical vulnerability (CVE-2024-13871), involves an unauthenticated command injection flaw in the /check_image_and_trigger_recovery API endpoint of Bitdefender BOX v1. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. When daemons restart using these compromised assets, attackers can achieve remote code execution on the device. The potential for remote code execution means attackers could deploy malware or backdoors on affected systems.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 13 Mar 2025 13:30:10 +0000