CVE-2021-3579

moderate-risk
Published 2021-10-28

Incorrect Default Permissions vulnerability in the bdservicehost.exe and Vulnerability.Scan.exe components as used in Bitdefender Endpoint Security Tools for Windows, Total Security allows a local attacker to elevate privileges to NT AUTHORITY\SYSTEM This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 7.2.1.65. Bitdefender Total Security versions prior to 7.2.1.65.

Do I need to act?

-
0.08% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (2)

Endpoint Security Tools

Affected Vendors

Bitdefender

References (4)

Vendor Advisory https://www.bitdefender.com/support/security-advisories/incorrect-default-permis...
Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-21-1277/
Vendor Advisory https://www.bitdefender.com/support/security-advisories/incorrect-default-permis...
Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-21-1277/
31
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 0/34 · Minimal
Exposure 7/34 · Low