Critical severity9.0NVD Advisory· Published Nov 24, 2021· Updated Jun 17, 2026

CVE-2021-3554

Description

Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the remote address used for pulling patches. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender Unified Endpoint versions prior to 6.2.21.160. Bitdefender GravityZone versions prior to 6.24.1-1.

Affected products

Bitdefender/Endpoint Security Tools2 versions
cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:*:*:*range: <6.6.27.390
- cpe:2.3:a:bitdefender:endpoint_security_tools:*:*:*:*:*:linux:*:*range: <6.6.27.390
Bitdefender/Gravityzone4 versions
cpe:2.3:a:bitdefender:gravityzone:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:bitdefender:gravityzone:*:*:*:*:*:*:*:*range: <6.24.1-1
- cpe:2.3:a:bitdefender:gravityzone:6.24.1-1:*:*:*:*:*:*:*
- (no CPE)range: <6.24.1-1
- (no CPE)range: unspecified
Bitdefender/Bitdefender Unified Endpointllm-create
Range: <6.2.21.160
Bitdefender/Endpoint Security Tools for Macllm-fuzzy2 versions
<6.6.27.390+ 1 more
- (no CPE)range: <6.6.27.390
- (no CPE)range: unspecified
Bitdefender/Unified Endpoint for Linuxcpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

www.bitdefender.com/support/security-advisories/improper-access-control-vulnerability-patchesupdate-api-va-9825nvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000