Read the docs
TI-2021-02506 Aliases CVE-2021-3553GHSA-6x2g-jp65-m547

Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825)

Priority LOW 35CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows an attacker to use the Endpoint Protection relay as a proxy for any remote host. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint for Linux versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.

Why it matters now

EPSS 0.01253 69th percentileScored 2026-11-07
Fix Fixed Endpoint Security Tools (Bitdefender): 6.6.27.390, 7.1.2.33Unified Endpoint for Linux (Bitdefender): 6.2.21.160+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BitdefenderEndpoint Security Toolsbefore 6.6.27.390; before 7.1.2.336.6.27.390, 7.1.2.33Patch availableCNA
BitdefenderUnified Endpoint for Linuxbefore 6.2.21.1606.2.21.160Patch availableCNA
BitdefenderGravityZonebefore 6.24.1-16.24.1-1Patch availableCNA
  • Endpoint Security Tools VendorBitdefender Affected before 6.6.27.390; before 7.1.2.33 Fixed in 6.6.27.390, 7.1.2.33 Patch available CNA
  • Unified Endpoint for Linux VendorBitdefender Affected before 6.2.21.160 Fixed in 6.2.21.160 Patch available CNA
  • GravityZone VendorBitdefender Affected before 6.24.1-1 Fixed in 6.24.1-1 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:linux:*:*before 6.2.21.160VulnerableBitdefender
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:*6.6.27.0 to before 6.6.27.390; 7.0.0.00 to before 7.1.2.33VulnerableBitdefender
cpe:2.3:a:bitdefender:gravityzone:6.24.1-1:*:*:*:*:*:*:*6.24.1-1VulnerableBitdefender
  • cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:linux:*:* Versions before 6.2.21.160 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:* Versions 6.6.27.0 to before 6.6.27.390; 7.0.0.00 to before 7.1.2.33 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:gravityzone:6.24.1-1:*:*:*:*:*:*:* Versions 6.24.1-1 Vulnerable ·Bitdefender

Remediation

  • Fix · CNA Endpoint Security Tools (Bitdefender) Fixed in 6.6.27.390, 7.1.2.33
  • Fix · CNA Unified Endpoint for Linux (Bitdefender) Fixed in 6.2.21.160
  • Fix · CNA GravityZone (Bitdefender) Fixed in 6.24.1-1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Bitdefender GravityZone 6.24.1-1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-02507 Improper access control in Bitdefender Endpoint Security Tools for LinuxPriority MEDIUM 47
    Show all 2 records →
  • Release ·

    Bitdefender Endpoint Security Tools 6.6.27.390, 7.1.2.33

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-02505 Insufficient validation on regular expression in EPPUpdateService config file (VA-9825)Priority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3553
  2. 2026-10-03 Alias added: GHSA-6x2g-jp65-m547

References

Advisory 1

Other 1

  • TI-2021-02507 Improper access control in Bitdefender Endpoint Security Tools for Linux CVSS 3.1CRITICAL 10.0
  • TI-2025-06435 Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security CVSS 4.0HIGH 8.8
  • TI-2021-02525 Privilege escalation via SeImpersonatePrivilege CVSS 3.1HIGH 7.8
  • TI-2021-02505 Insufficient validation on regular expression in EPPUpdateService config file (VA-9825) CVSS 3.1HIGH 7.5
  • TI-2022-00592 Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144) CVSS 3.1HIGH 7.5
  • TI-2021-03065 Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017) CVSS 3.1HIGH 7.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences