title: Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)
description: An Untrusted Search Path vulnerability in EPSecurityService.exe as used in Bitdefender Endpoint Security Tools versions prior to 6.6.11.163 allows an attacker to load an arbitrary DLL file from the search path. This issue affects: Bitdefender EPSecurityService.exe versions prior to 6.6.11.163.
problem types: CWE-426 Untrusted Search Path
affected:
{
product: EPSecurityService.exe
vendor: Bitdefender
versions:
status: affected, version: 6.6.11.162 and prior
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
version: 3.1
]
solutions: Automatic update to version 6.6.11.163 mitigates the issue.