Read the docs
TI-2021-02505 Aliases CVE-2021-3552GHSA-pr6v-cc4g-cpxj

Insufficient validation on regular expression in EPPUpdateService config file (VA-9825)

Priority LOW 36CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender GravityZone 6.24.1-1.

Why it matters now

EPSS 0.01339 71st percentileScored 2026-11-08
Fix Fixed Endpoint Security Tools (Bitdefender): 6.6.27.390, 7.1.2.33

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BitdefenderEndpoint Security Toolsbefore 6.6.27.390; before 7.1.2.336.6.27.390, 7.1.2.33Patch availableCNA
BitdefenderGravityZone6.24.1-1—No fix listedCNA
  • Endpoint Security Tools VendorBitdefender Affected before 6.6.27.390; before 7.1.2.33 Fixed in 6.6.27.390, 7.1.2.33 Patch available CNA
  • GravityZone VendorBitdefender Affected 6.24.1-1 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:-:*:*before 6.2.21.160VulnerableBitdefender
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:*6.6.27.0 to before 6.6.27.390; 7.0.0.00 to before 7.1.2.33VulnerableBitdefender
cpe:2.3:a:bitdefender:gravityzone:6.24.1-1:*:*:*:*:*:*:*6.24.1-1VulnerableBitdefender
  • cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:-:*:* Versions before 6.2.21.160 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:* Versions 6.6.27.0 to before 6.6.27.390; 7.0.0.00 to before 7.1.2.33 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:gravityzone:6.24.1-1:*:*:*:*:*:*:* Versions 6.24.1-1 Vulnerable ·Bitdefender

Remediation

  • Fix · CNA Endpoint Security Tools (Bitdefender) Fixed in 6.6.27.390, 7.1.2.33

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Bitdefender Endpoint Security Tools 6.6.27.390, 7.1.2.33

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-02506 Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825)Priority LOW 35
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3552
  2. 2026-10-03 Alias added: GHSA-pr6v-cc4g-cpxj

References

Other 1

  • TI-2021-02507 Improper access control in Bitdefender Endpoint Security Tools for Linux CVSS 3.1CRITICAL 10.0
  • TI-2025-06435 Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security CVSS 4.0HIGH 8.8
  • TI-2021-02525 Privilege escalation via SeImpersonatePrivilege CVSS 3.1HIGH 7.8
  • TI-2022-00592 Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144) CVSS 3.1HIGH 7.5
  • TI-2021-03065 Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017) CVSS 3.1HIGH 7.8
  • TI-2021-02528 Incorrect Default Permissions vulnerability in bdservicehost.exe and Vulnerability.Scan.exe CVSS 3.1HIGH 7.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences