Improper Handling of Length Parameter Inconsistency vulnerability in Bitdefender Update Server (VA-10144)
Priority LOW 35CWE-130Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111.
Why it matters now
EPSS 0.01249 69th percentileScored 2026-11-07
Fix Fixed Update Server (Bitdefender): 3.4.0.276GravityZone (Bitdefender): 26.4-1+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Bitdefender | Update Server | before 3.4.0.276 | 3.4.0.276 | Patch available | CNA |
| Bitdefender | GravityZone | before 26.4-1 | 26.4-1 | Patch available | CNA |
| Bitdefender | Endpoint Security Tools for Linux | before 6.2.21.171 | 6.2.21.171 | Patch available | CNA |
| Bitdefender | Endpoint Security Tools for Windows | before 7.4.1.111 | 7.4.1.111 | Patch available | CNA |
- Update Server VendorBitdefender Affected before 3.4.0.276 Fixed in 3.4.0.276 Patch available CNA
- GravityZone VendorBitdefender Affected before 26.4-1 Fixed in 26.4-1 Patch available CNA
- Endpoint Security Tools for Linux VendorBitdefender Affected before 6.2.21.171 Fixed in 6.2.21.171 Patch available CNA
- Endpoint Security Tools for Windows VendorBitdefender Affected before 7.4.1.111 Fixed in 7.4.1.111 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:linux:*:* | before 6.2.21.171 | Vulnerable | Bitdefender |
| cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:windows:*:* | before 7.4.1.111 | Vulnerable | Bitdefender |
| cpe:2.3:a:bitdefender:gravityzone:*:*:*:*:*:*:*:* | before 26.4-1 | Vulnerable | Bitdefender |
| cpe:2.3:a:bitdefender:update_server:*:*:*:*:*:*:*:* | before 3.4.0.276 | Vulnerable | Bitdefender |
- cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:linux:*:* Versions before 6.2.21.171 Vulnerable ·Bitdefender
- cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:windows:*:* Versions before 7.4.1.111 Vulnerable ·Bitdefender
- cpe:2.3:a:bitdefender:gravityzone:*:*:*:*:*:*:*:* Versions before 26.4-1 Vulnerable ·Bitdefender
- cpe:2.3:a:bitdefender:update_server:*:*:*:*:*:*:*:* Versions before 3.4.0.276 Vulnerable ·Bitdefender
Remediation
- Fix · CNA Update Server (Bitdefender) Fixed in 3.4.0.276
- Fix · CNA GravityZone (Bitdefender) Fixed in 26.4-1
- Fix · CNA Endpoint Security Tools for Linux (Bitdefender) Fixed in 6.2.21.171
- Fix · CNA Endpoint Security Tools for Windows (Bitdefender) Fixed in 7.4.1.111
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0677
- 2026-10-03 Alias added: GHSA-3vhp-778q-hqrc
References
More Bitdefender Endpoint Security Tools vulnerabilities
- TI-2021-02507 Improper access control in Bitdefender Endpoint Security Tools for Linux CVSS 3.1CRITICAL 10.0
- TI-2025-06435 Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security CVSS 4.0HIGH 8.8
- TI-2021-02525 Privilege escalation via SeImpersonatePrivilege CVSS 3.1HIGH 7.8
- TI-2021-02505 Insufficient validation on regular expression in EPPUpdateService config file (VA-9825) CVSS 3.1HIGH 7.5
- TI-2021-03065 Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017) CVSS 3.1HIGH 7.8
- TI-2021-02528 Incorrect Default Permissions vulnerability in bdservicehost.exe and Vulnerability.Scan.exe CVSS 3.1HIGH 7.8
Sources
- CVE-2022-0677 · CVE Program
- CVE-2022-0677 · NVD
- FIRST EPSS
- GHSA-3vhp-778q-hqrc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences