Critical severity · published Sep 5, 2022
CVE-2022-2830
Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the…
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console allows an attacker to pass unsafe commands to the environment. This issue affects: Bitdefender GravityZone Console On-Premise versions prior to 6.29.2-1. Bitdefender GravityZone Cloud Console versions prior to 6.27.2-2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Gravityzone · Bitdefender
before 6.27.2-2; before 6.29.2-1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-2830
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-2830
Vendor Advisory
https://www.bitdefender.com/support/security-advisories/deserialization-of-untrusted-data-in-gravityzone-console-va-10573
More from Gravityzone
10.0
CVE-2021-3554
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for Linux as a relay role allows an attacker to manipulate the…
9.8
CVE-2025-2244
Insecure PHP deserialization issue in GravityZone Console (VA-12634)
9.8
CVE-2024-6980
Verbose error handling issue in GravityZone Update Server proxy service
9.8
CVE-2024-4177
Host whitelist parser issue in GravityZone Console On-Premise (VA-11554)
9.8
CVE-2024-2224
Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)