CVE-2025-2245: Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-04-04 · updated 2026-06-17
Weakness: CWE-918

Description

A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.

Affected products

Bitdefender Gravityzone Update Server: before 3.5.2.689 — fixed in 3.5.2.689

How to fix

Upgrade to a fixed version: Bitdefender Gravityzone Update Server 3.5.2.689. Check the vendor advisory for mitigations.

References

https://www.bitdefender.com/support/security-advisories/server-side-request-forgery-in-gravityzone-update-server-using-null-bytes-va-12646

Get alerted when CVE-2025-2245 or the next vulnerability affects your stack