CVE-2023-6154: bitdefender antivirus
Vulnerability summary
CVE-2023-6154 is a high (CVSS 7.8) vulnerability in bitdefender antivirus. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.1% of scored vulnerabilities.
Timeline
- 01-04-2024PublishedVulnerability first disclosed.
- 12-08-2024Last modifiedVulnerability information updated.
Description
A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This issue affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus Plus: 27.0.25.114; Antivirus Free: 27.0.25.114.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
0.00 pp
From 0.20% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-15External Control of System or Configuration SettingOne or more system settings or configuration elements can be externally controlled by a user.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
Bitdefender5 products
- antivirus27.0.25.114
- antivirus free27.0.25.114
- antivirus_plus27.0.25.114
- internet_security27.0.25.114
- total_security27.0.25.114
1 vendor · 5 products
References
1 links- bitdefender.com/support/…Vendor Advisory