CVE-2024-13872 Overview
CVE-2024-13872 affects Bitdefender Box firmware versions 1.3.11.490 through 1.3.11.505. The device downloads update assets, daemons, and detection rules over unencrypted HTTP. An attacker on the adjacent network can trigger an update through the /set_temp_token API method without authentication. The attacker then intercepts the plaintext download and substitutes malicious binaries. When the device restarts daemons that load the tampered assets, the attacker gains remote code execution on the appliance. The flaw is tracked under CWE-319: Cleartext Transmission of Sensitive Information.
Critical Impact
An unauthenticated, network-adjacent attacker can achieve remote code execution on Bitdefender Box by performing a machine-in-the-middle attack against the HTTP update channel.
Affected Products
- Bitdefender Box hardware appliance (version 1)
- Bitdefender Box firmware 1.3.11.490
- Bitdefender Box firmware through 1.3.11.505
Discovery Timeline
- 2025-03-12 - CVE-2024-13872 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13872
Vulnerability Analysis
Bitdefender Box relies on the libboxhermes.so library to fetch runtime components from Bitdefender infrastructure. According to the Bitdefender Security Advisory, the update client requests these assets over HTTP rather than HTTPS. The device does not verify signatures on the downloaded artifacts before executing them. The /set_temp_token API endpoint accepts requests without authentication and triggers the vulnerable update routine. This combination transforms any position on the local network segment into a full compromise vector.
Root Cause
The root cause is insecure communication design. The firmware transmits update requests and receives executable payloads in cleartext. There is no channel encryption, no server certificate validation, and no cryptographic verification of downloaded daemon binaries or rule sets. Compounding the issue, the update trigger endpoint accepts unauthenticated requests, so an adversary can force the vulnerable download on demand rather than waiting for a scheduled refresh.
Attack Vector
An attacker positioned on the same Layer 2 network as the Bitdefender Box appliance sends an unauthenticated request to the /set_temp_token endpoint. This causes the device to initiate an HTTP update fetch. The attacker uses ARP spoofing, rogue DHCP, DNS poisoning, or a compromised upstream router to intercept the request. The attacker returns a crafted response containing malicious daemon binaries or detection rules. When the Box restarts the affected daemon, it loads the attacker-controlled code and executes it in the daemon's process context, granting the attacker persistent control of the device.
No public proof-of-concept exploit code has been released. Refer to the vendor advisory for further technical detail.
Detection Methods for CVE-2024-13872
Indicators of Compromise
- Outbound HTTP traffic from the Bitdefender Box appliance to hosts other than official Bitdefender update endpoints
- Unexpected /set_temp_token API requests originating from local network hosts
- ARP table anomalies or duplicate MAC-to-IP bindings on the network segment where the Box operates
- Unscheduled daemon restarts on the Box outside of the vendor's normal update cadence
Detection Strategies
- Inspect network traffic for cleartext HTTP downloads of executable content on the LAN segment hosting the appliance
- Alert on unauthenticated calls to /set_temp_token observed in mirrored or SPAN traffic
- Correlate ARP spoofing signatures with subsequent HTTP traffic to or from the Box
Monitoring Recommendations
- Enable DHCP snooping and Dynamic ARP Inspection on switches serving the Bitdefender Box VLAN
- Forward network flow and DNS telemetry to a centralized analytics platform for baseline deviation analysis
- Track firmware version reporting from the appliance to confirm devices are patched off the vulnerable 1.3.11.490 through 1.3.11.505 range
How to Mitigate CVE-2024-13872
Immediate Actions Required
- Confirm that Bitdefender Box devices have received the vendor-supplied automatic update that remediates the insecure update mechanism
- Isolate Bitdefender Box appliances on a dedicated VLAN with restricted client access
- Restrict which devices on the LAN can reach the appliance's management API
Patch Information
Bitdefender addressed the issue in libboxhermes.so through an automatic firmware update pushed to affected Box v1 devices. Administrators should verify their appliance reports a firmware version later than 1.3.11.505. See the Bitdefender Security Advisory for full remediation guidance.
Workarounds
- Enforce Layer 2 protections such as Dynamic ARP Inspection and port security to reduce machine-in-the-middle exposure
- Segment the Bitdefender Box onto a management VLAN unreachable from guest and untrusted device networks
- Monitor upstream gateway integrity to prevent DNS or routing manipulation of update traffic
# Example: enable Dynamic ARP Inspection on the VLAN hosting the appliance (Cisco IOS)
configure terminal
ip arp inspection vlan 20
interface range GigabitEthernet1/0/1 - 24
ip arp inspection trust
end
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
