Log in Start free

Vulnerability · Published Mar 7, 2022 · Assigned by Bitdefender

CVE-2021-4199Incorrect Permission Assignment for Critical Resource vulnerability in BDReinit.exe (VA-10017)

High 7.8

In plain English

A high-severity incorrect permission assignment in Antivirus Plus from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.8%top 44.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Incorrect Permission Assignment for Critical Resource vulnerability in the crash handling component BDReinit.exe as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools for Windows allows a remote attacker to escalate local privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to 26.0.10.45. Bitdefender Internet Security versions prior to 26.0.10.45. Bitdefender Antivirus Plus versions prior to 26.0.10.45. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.3.146.

Affected products (as reported)

VendorProductVersions
Bitdefender Total Security unspecified – before 26.0.10.45
Bitdefender Internet Security unspecified – before 26.0.10.45
Bitdefender Antivirus Plus unspecified – before 26.0.10.45
Bitdefender Endpoint Security Tools for Windows unspecified – before 7.4.3.140

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References