Read the docs
TI-2021-02507 Aliases CVE-2021-3554GHSA-6wjr-cr9m-279q

Improper access control in Bitdefender Endpoint Security Tools for Linux

Priority MEDIUM 47CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.

Why it matters now

EPSS 0.02117 81st percentileScored 2026-11-07
Fix Fixed Endpoint Security Tools for Linux (Bitdefender): 6.6.27.390, 7.1.2.33Unified Endpoint (Bitdefender): 6.2.21.160+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BitdefenderEndpoint Security Tools for Linuxbefore 6.6.27.390; before 7.1.2.336.6.27.390, 7.1.2.33Patch availableCNA
BitdefenderUnified Endpointbefore 6.2.21.1606.2.21.160Patch availableCNA
BitdefenderGravityZonebefore 6.24.1-16.24.1-1Patch availableCNA
  • Endpoint Security Tools for Linux VendorBitdefender Affected before 6.6.27.390; before 7.1.2.33 Fixed in 6.6.27.390, 7.1.2.33 Patch available CNA
  • Unified Endpoint VendorBitdefender Affected before 6.2.21.160 Fixed in 6.2.21.160 Patch available CNA
  • GravityZone VendorBitdefender Affected before 6.24.1-1 Fixed in 6.24.1-1 Patch available CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:*before 6.6.27.390VulnerableBitdefender
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:linux:*:*before 6.6.27.390VulnerableBitdefender
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:*7.0.0.00 to before 7.1.2.33VulnerableBitdefender
cpe:2.3:a:bitdefender:gravityzone:*:*:*:*:*:*:*:*before 6.24.1-1VulnerableBitdefender
cpe:2.3:a:bitdefender:gravityzone:6.24.1-1:*:*:*:*:*:*:*6.24.1-1VulnerableBitdefender
  • cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:* Versions before 6.6.27.390 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:linux:*:* Versions before 6.6.27.390 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:* Versions 7.0.0.00 to before 7.1.2.33 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:gravityzone:*:*:*:*:*:*:*:* Versions before 6.24.1-1 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:gravityzone:6.24.1-1:*:*:*:*:*:*:* Versions 6.24.1-1 Vulnerable ·Bitdefender

Remediation

  • Fix · CNA Endpoint Security Tools for Linux (Bitdefender) Fixed in 6.6.27.390, 7.1.2.33
  • Fix · CNA Unified Endpoint (Bitdefender) Fixed in 6.2.21.160
  • Fix · CNA GravityZone (Bitdefender) Fixed in 6.24.1-1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Bitdefender GravityZone 6.24.1-1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-02506 Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825)Priority LOW 35
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3554
  2. 2026-10-03 Alias added: GHSA-6wjr-cr9m-279q

References

Other 1

  • TI-2025-06435 Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security CVSS 4.0HIGH 8.8
  • TI-2021-02525 Privilege escalation via SeImpersonatePrivilege CVSS 3.1HIGH 7.8
  • TI-2021-02505 Insufficient validation on regular expression in EPPUpdateService config file (VA-9825) CVSS 3.1HIGH 7.5
  • TI-2022-00592 Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144) CVSS 3.1HIGH 7.5
  • TI-2021-03065 Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017) CVSS 3.1HIGH 7.8
  • TI-2021-02528 Incorrect Default Permissions vulnerability in bdservicehost.exe and Vulnerability.Scan.exe CVSS 3.1HIGH 7.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences