CVE-2024-13872: Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.so
Bitdefender Box, versions 1.3.11.490 through 1.3.11.505, uses the insecure HTTP protocol to download assets over the Internet to update and restart daemons and detection rules on the devices. Updates can be remotely triggered through the /settemptoken API method. Then, an unauthenticated and network-adjacent attacker can use man-in-the-middle (MITM) techniques to return malicious responses. Restarted daemons that use malicious assets can then be exploited for remote code execution on the device.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13872?
CVE-2024-13872 is considered a high severity vulnerability due to the use of insecure HTTP protocol for downloading updates.
How do I fix CVE-2024-13872?
To fix CVE-2024-13872, update your Bitdefender Box to version 1.3.11.506 or later, which resolves the insecure update mechanism.
What versions of Bitdefender Box are affected by CVE-2024-13872?
CVE-2024-13872 affects Bitdefender Box versions from 1.3.11.490 to 1.3.11.505.
What can an attacker do by exploiting CVE-2024-13872?
An attacker exploiting CVE-2024-13872 could potentially download malicious assets to the device due to the insecure update mechanism.
Is there a workaround for CVE-2024-13872 until a fix is applied?
There is no official workaround for CVE-2024-13872 other than upgrading to the fixed version as soon as possible.