CVE-2025-2243mediumCWE-918

CVE-2025-2243: medium-severity vulnerability in Bitdefender GravityZone Console

SSRF in GravityZone Console via DNS Truncation (VA-12634)

Published

Follow this CVE+ Monitor GravityZone Console

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.4%
A server-side request forgery (SSRF) vulnerability in Bitdefender GravityZone Console allows an attacker to bypass input validation logic using leading characters in DNS requests. Paired with other potential vulnerabilities, this bypass could be used for execution of third party code. This issue affects GravityZone Console: before 6.41.2.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Affected products
Bitdefender · GravityZone Console
Related CVEs — Bitdefender GravityZone Console

In the same product, most dangerous first.

CVE-2025-2244CRITICALInsecure PHP deserialization issue in GravityZone Console (VA-12634)EPSS 1.1%