PT-2025-14874 · Bitdefender · Bitdefender Gravityzone Console

Nicolas Verdier · Published 2025-04-04 · Updated 2025-04-07 · CVE-2025-2244

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bitdefender GravityZone Console (affected versions not specified)

Description A vulnerability exists in the sendMailFromRemoteSource method in Emails.php, which unsafely uses the php unserialize() function on user-supplied input without validation. This allows an attacker to craft a malicious serialized payload, triggering PHP object injection, performing a file write, and gaining arbitrary command execution on the host system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-2244

Affected Products

Bitdefender Gravityzone Console

References · 12

• http://bitdefender.com/support/security-advisories/insecure-php-deserialization-issue-in-gravityzone-console-va-12634 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2244 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2244 · Vendor Advisory
• https://twitter.com/WolfgangSesin/status/1908118648943718864 · Twitter Post
• https://t.me/cvetracker/20808 · Telegram Post
• https://twitter.com/CveFindCom/status/1908097534205075583 · Twitter Post
• https://twitter.com/vuldb/status/1908428277016125662 · Twitter Post
• https://t.me/cvedetector/22117 · Telegram Post
• https://t.me/cvenotify/117725 · Telegram Post
• https://twitter.com/dailytechonx/status/1909320272370659618 · Twitter Post
• https://twitter.com/CVEnew/status/1908438501709721704 · Twitter Post
• https://twitter.com/CCBalert/status/1909235869711479224 · Twitter Post