CVE-2025-2244

CRITICAL

Bitdefender Gravityzone < 6.41.2-1 - Insecure Deserialization

Title source: rule

Description

A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.

References (1)

[Vendor Advisory] http://bitdefender.com/support/security-advisories/insecure-php-deserialization-issue-in-gravityzone-console-va-12634

Scores

CVSS v3 9.8

EPSS 0.0186

EPSS Percentile 82.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (1)

bitdefender/gravityzone < 6.41.2-1

Timeline

Published Apr 04, 2025

Tracked Since Feb 18, 2026