Vulnerability in Bitdefender Box
CVE-2024-13872
Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /…
EPSS: 0.002 (13.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Bitdefender Box
- Bitdefender Box_firmware
- Bitdefender Box V1 — versions 1.3.11.490
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve-requests@bitdefender.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-13872?
- CVE-2024-13872 is a high-severity vulnerability in Bitdefender Box, classified under Cleartext Transmission of Sensitive Information. CVSS score: 7.5/10. Published 2025-03-12.
- How severe is CVE-2024-13872?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-13872 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.