CVE-2023-49567

MEDIUM

Bitdefender Total Security < 27.0.25.115 - Improper Certificate Validation via MD5 and SHA1 Collision Hash Functions

Title source: llm

Description

A vulnerability has been identified in the Bitdefender Total Security HTTPS scanning functionality where the product incorrectly checks the site's certificate, which allows an attacker to make MITM SSL connections to an arbitrary site. The product trusts certificates that are issued using the MD5 and SHA1 collision hash functions which allow attackers to create rogue certificates that appear legitimate.

References (1)

Core 1

Core References

Vendor Advisory

https://www.bitdefender.com/support/security-advisories/insecure-trust-of-certificates-using-collision-hash-functions-in-bitdefender-total-security-https-scanning-va-11239/

Scores

CVSS v3 6.8

EPSS 0.0018

EPSS Percentile 7.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-295

Status published

Products (1)

bitdefender/total_security < 27.0.25.115

Published Oct 18, 2024

Tracked Since Feb 18, 2026