title: Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646)
description: An improper authentication vulnerability in Bitdefender Endpoint Security Tools for Windows and Bitdefender Endpoint Security SDK allows an unprivileged local attacker to escalate privileges or tamper with the product's security settings. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. This issue affects: Bitdefender Endpoint Security Tools for Windows versions prior to 6.6.18.261. Bitdefender Endpoint Security SDK versions prior to 6.6.18.261.
problem types: CWE-287 Improper Authentication
affected:
{
product: Endpoinit Security Tools for Windows
vendor: Bitdefender
versions:
lessThan: 6.6.18.261, status: affected, version: unspecified, versionType: custom
}
{
product: Endpoint Security SDK
vendor: Bitdefender
versions:
lessThan: 6.6.18.261, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H
version: 3.1
]
solutions: An automatic update to Bitdefender Endpoint Security Tools / Bitdefender Endpoint Security SDK version 6.6.18.261 or newer fixes the issue.