CVE-2021-3552: Insufficient validation on regular expression in EPPUpdateService config file (VA-9825)

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-24 · updated 2026-06-17
Weakness: CWE-918

Description

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender GravityZone 6.24.1-1.

Affected products

Bitdefender Endpoint Security Tools: before 6.2.21.160; from 6.6.27.0 before 6.6.27.390; from 7.0.0.00 before 7.1.2.33 — fixed in 6.2.21.160, 6.6.27.390, 7.1.2.33
Bitdefender GravityZone: 6.24.1-1

How to fix

Upgrade to a fixed version: Bitdefender Endpoint Security Tools 6.2.21.160, 6.6.27.390, 7.1.2.33. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3552 or the next vulnerability affects your stack