title: Local privilege escalation in Bitdefender Total Security (VA-11168)
description: A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This issue affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus Plus: 27.0.25.114; Antivirus Free: 27.0.25.114.
problem types: CWE-15: External Control of System or Configuration Setting
affected:
{
defaultStatus: unaffected
product: Total Security
vendor: Bitdefender
versions:
status: affected, version: 27.0.25.114
}
{
defaultStatus: unaffected
product: Internet Security
vendor: Bitdefender
versions:
status: affected, version: 27.0.25.114
}
{
defaultStatus: unaffected
product: Antivirus Plus
vendor: Bitdefender
versions:
status: affected, version: 27.0.25.114
}
{
defaultStatus: unaffected
product: Antivirus Free
vendor: Bitdefender
versions:
status: affected, version: 27.0.25.114
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: An automatic update to version 27.0.25.115 fixes the issue.