CVE-2025-2244

The application calls the PHP unserialize() function on user-supplied data without any validation of its correctness or security. An attacker can craft a malicious, properly formatted serialized payload and submit it to the vulnerable method. This causes PHP object injection, which can subsequently be exploited to write files to the server. Arbitrary file writing ultimately enables execution of arbitrary system commands on the host.

An unauthenticated remote attacker can gain full control over the system hosting Bitdefender GravityZone Console, including executing arbitrary system commands with application process privileges. This can lead to complete compromise of the entire environment managed by the security console.

Patches available from the vendor should be applied according to references (vendor advisory: VA-12634, available at bitdefender.com/support/security-advisories/insecure-php-deserialization-issue-in-gravityzone-console-va-12634)

Bitdefender GravityZone Console — versions specified in vendor references