TI-2023-05659 Aliases CVE-2023-6154 GHSA-x5jv-pxjq-575r

Local privilege escalation in Bitdefender Total Security (VA-11168)

LOW 35CWE-15Published 2024-04-01 · Updated 2024-08-12

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This issue affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus Plus: 27.0.25.114; Antivirus Free: 27.0.25.114.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.002 9th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Bitdefender	Total Security	27.0.25.114	—	No fix listed	CNA
Bitdefender	Internet Security	27.0.25.114	—	No fix listed	CNA
Bitdefender	Antivirus Plus	27.0.25.114	—	No fix listed	CNA
Bitdefender	Antivirus Free	27.0.25.114	—	No fix listed	CNA

Total Security VendorBitdefender Affected 27.0.25.114 Fixed in — No fix listed CNA
Internet Security VendorBitdefender Affected 27.0.25.114 Fixed in — No fix listed CNA
Antivirus Plus VendorBitdefender Affected 27.0.25.114 Fixed in — No fix listed CNA
Antivirus Free VendorBitdefender Affected 27.0.25.114 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:bitdefender:antivirus:27.0.25.114::::free:::	27.0.25.114	Vulnerable	Bitdefender
cpe:2.3:a:bitdefender:antivirus_plus:27.0.25.114:::::::*	27.0.25.114	Vulnerable	Bitdefender
cpe:2.3:a:bitdefender:internet_security:27.0.25.114:::::::*	27.0.25.114	Vulnerable	Bitdefender
cpe:2.3:a:bitdefender:total_security:27.0.25.114:::::::*	27.0.25.114	Vulnerable	Bitdefender

cpe:2.3:a:bitdefender:antivirus:27.0.25.114:*:*:*:free:*:*:* Versions 27.0.25.114 Vulnerable ·Bitdefender
cpe:2.3:a:bitdefender:antivirus_plus:27.0.25.114:*:*:*:*:*:*:* Versions 27.0.25.114 Vulnerable ·Bitdefender
cpe:2.3:a:bitdefender:internet_security:27.0.25.114:*:*:*:*:*:*:* Versions 27.0.25.114 Vulnerable ·Bitdefender
cpe:2.3:a:bitdefender:total_security:27.0.25.114:*:*:*:*:*:*:* Versions 27.0.25.114 Vulnerable ·Bitdefender

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-6154
2026-10-03 Alias added: GHSA-x5jv-pxjq-575r

References

Advisory 1

https://bitdefender.com/support/security-advisories/local-privilege-escalation-in-bitdefender-total-security-va-11168/

TI-2007-05541 Unspecified vulnerability in BitDefender allows attackers to execute arbitrary code via… CVSS 3.1CRITICAL 9.8
TI-2008-05149 Unspecified vulnerability in the pdf.xmd module in (1) BitDefender Free Edition 10 and… CVSS 2.0HIGH 9.3
TI-2025-06435 Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security CVSS 4.0HIGH 8.8
TI-2020-06515 Code Injection into Bitdefender AV for Mac CVSS 3.1HIGH 7.8
TI-2020-06514 Privilege escalation in Bitdefender AV for Mac CVSS 3.1MEDIUM 5.5
TI-2019-12759 Get-task-allow entitlement via BDLDaemon on macOS CVSS 3.1MEDIUM 5.5

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences