Vulnerability · Published Apr 4, 2025 · Assigned by Bitdefender

CVE-2025-2244Insecure PHP deserialization issue in GravityZone Console (VA-12634)

Critical 9.5

In plain English

A critical-severity unsafe deserialization in GravityZone Console from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 4.0)9.5Critical

Exploit odds (30 days)1.1%top 33.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.

Affected products (as reported)

Vendor	Product	Versions
Bitdefender	GravityZone Console	0 – before 6.41.2-1

Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

http://bitdefender.com/support/security-advisories/insecure-php-deserialization-issue-in-gravityzone-console-va-12634