PT-2025-14873 · Bitdefender · Bitdefender Gravityzone Console

Nicolas Verdier · Published 2025-04-04 · Updated 2025-04-05 · CVE-2025-2243

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Bitdefender GravityZone Console versions prior to 6.41.2.1

Description A server-side request forgery (SSRF) issue allows an attacker to bypass input validation logic using leading characters in DNS requests. This could potentially be used for the execution of third-party code when paired with other vulnerabilities.

Recommendations For versions prior to 6.41.2.1, update to version 6.41.2.1 or later to resolve the issue. As a temporary workaround, consider restricting DNS requests to prevent exploitation of the SSRF vulnerability.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-2243

Affected Products

Bitdefender Gravityzone Console

References · 8

• https://osv.dev/vulnerability/CVE-2025-2243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2243 · Security Note
• https://bitdefender.com/support/security-advisories/ssrf-in-gravityzone-console-via-dns-truncation-va-12634 · Vendor Advisory
• https://twitter.com/CVEnew/status/1908438500061458483 · Twitter Post
• https://t.me/cvenotify/117724 · Telegram Post
• https://t.me/cvetracker/20807 · Telegram Post
• https://t.me/cvedetector/22116 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1908118695131439468 · Twitter Post