CVE-2022-3369: Improper handling of registry symbolic links in Bitdefender Engines
An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender Engines versions prior to 7.92659. It also affects Bitdefender Antivirus Free, Bitdefender Antivirus Plus, Bitdefender Internet Security, Bitdefender Total Security, as well as Bitdefender Endpoint Security Tools for Windows with engine versions prior to 7.92659.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2022-3369.
What is the severity of CVE-2022-3369?
CVE-2022-3369 has a severity level of high.
What is the affected software?
The affected software is Bitdefender Engines versions prior to 7.92659.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by pointing a Registry symlink to a privileged key and deleting privileged registry keys.
Is there a fix available for CVE-2022-3369?
Yes, a fix is available for CVE-2022-3369 in Bitdefender Engines version 7.92659 and above.