Read the docs
TI-2021-02528 Aliases CVE-2021-3579GHSA-83r8-pm82-6w92

Incorrect Default Permissions vulnerability in bdservicehost.exe and Vulnerability.Scan.exe

Priority LOW 35CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for Windows, Total Security allows a local attacker to elevate privileges to NT AUTHORITY\SYSTEM This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 7.2.1.65. Bitdefender Total Security versions prior to 7.2.1.65.

Why it matters now

EPSS 0.00693 53rd percentileScored 2026-11-07
Fix Fixed ENdpoint Security Tools for Windows (Bitdefender): 7.2.1.65Total Security (Bitdefender): 7.2.1.65

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
BitdefenderENdpoint Security Tools for Windowsbefore 7.2.1.657.2.1.65Patch availableCNA
BitdefenderTotal Securitybefore 7.2.1.657.2.1.65Patch availableCNA
  • ENdpoint Security Tools for Windows VendorBitdefender Affected before 7.2.1.65 Fixed in 7.2.1.65 Patch available CNA
  • Total Security VendorBitdefender Affected before 7.2.1.65 Fixed in 7.2.1.65 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:windows:*:*before 7.2.1.65VulnerableBitdefender
cpe:2.3:a:bitdefender:total_security:*:*:*:*:*:*:*:*before 7.2.1.65VulnerableBitdefender
  • cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:windows:*:* Versions before 7.2.1.65 Vulnerable ·Bitdefender
  • cpe:2.3:a:bitdefender:total_security:*:*:*:*:*:*:*:* Versions before 7.2.1.65 Vulnerable ·Bitdefender

Remediation

  • Fix · CNA ENdpoint Security Tools for Windows (Bitdefender) Fixed in 7.2.1.65
  • Fix · CNA Total Security (Bitdefender) Fixed in 7.2.1.65

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3579
  2. 2026-10-03 Alias added: GHSA-83r8-pm82-6w92

References

Advisory 2

  • TI-2021-02507 Improper access control in Bitdefender Endpoint Security Tools for Linux CVSS 3.1CRITICAL 10.0
  • TI-2025-06435 Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security CVSS 4.0HIGH 8.8
  • TI-2021-02525 Privilege escalation via SeImpersonatePrivilege CVSS 3.1HIGH 7.8
  • TI-2021-02505 Insufficient validation on regular expression in EPPUpdateService config file (VA-9825) CVSS 3.1HIGH 7.5
  • TI-2022-00592 Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144) CVSS 3.1HIGH 7.5
  • TI-2021-03065 Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017) CVSS 3.1HIGH 7.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences