CVE-2025-2244 - CVE House
Back to Database
Status published Critical CVE-2025-2244

Insecure PHP deserialization issue in GravityZone Console (VA-12634)

Vulnerability Description

A vulnerability in the sendMailFromRemoteSource method in Emails.php  as used in Bitdefender GravityZone Console unsafely uses php unserialize() on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write, and gain arbitrary command execution on the host system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2244

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Nicolas Verdier (@n1nj4sec)

References

More from Bitdefender

View All →
CVE-2025-7073
Local Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security
High 8.8
CVE-2025-5317
Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac
Medium 6.8
CVE-2025-2245
Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)
Medium 6.9
CVE-2025-2243
SSRF in GravityZone Console via DNS Truncation (VA-12634)
Medium 6.9
CVE-2024-6980
Verbose error handling issue in GravityZone Update Server proxy service
Critical 9.2

Affected Vendor

Bitdefender

View all reports →

Affected Software

GravityZone Console
Vulnerable Versions:
0

Timeline

Official Publish: April 4th, 2025
Last Modified: April 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-502

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1068 Exploitation for Privilege Escalation
Privilege Escalation