CVE-2014-5350

Bitdefender GravityZone < 5.1.5.386 - Path Traversal via Web Console or Update Server

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-5350. PoCs published by SEC Consult.

AI-analyzed exploit summary The advisory details multiple critical vulnerabilities in Bitdefender GravityZone, including unauthenticated local file disclosure, insecure MongoDB service configuration with hardcoded credentials, and missing authentication for certain administrative scripts. These vulnerabilities allow attackers to gain system and database access, as well as manage endpoints.

Description

Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the id parameter to webservice/CORE/downloadFullKitEpc/a/1 in the Web Console or (2) %2E%2E (encoded dot dot) in the default URI to port 7074 on the Update Server.

Exploits (1)

exploitdb WRITEUP
by SEC Consult · textwebappslinux
https://www.exploit-db.com/exploits/34086

The advisory details multiple critical vulnerabilities in Bitdefender GravityZone, including unauthenticated local file disclosure, insecure MongoDB service configuration with hardcoded credentials, and missing authentication for certain administrative scripts. These vulnerabilities allow attackers to gain system and database access, as well as manage endpoints.

Classification
Writeup 100%
Attack Type
Info Leak | Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: Bitdefender GravityZone <5.1.11.432
No auth needed
Prerequisites: Network access to the target system
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

EPSS 0.6389
EPSS Percentile 99.1%

Details

CWE
CWE-22
Status published
Products (1)
bitdefender/gravityzone < 5.1.5.386
Published Aug 19, 2014
Tracked Since Feb 18, 2026