Security Resilience

CVE-2023-6154

Bitdefender Antivirus 27.0.25.114

Published
01 April 2024
Modified
07 February 2025
Patch / advisory
View advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0020 9th percentile
Risk Priority 55 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-6154 is a high-severity External Control of System or Configuration Setting (CWE-15) vulnerability in Bitdefender Antivirus. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Winlogon Helper DLL (T1547.004); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A02:2025 Security MisconfigurationA05:2025 Injection

EU & UK References

Vulnerability Data

A configuration setting issue in seccenter.exe as used in Bitdefender Total Security, Bitdefender Internet Security, Bitdefender Antivirus Plus, Bitdefender Antivirus Free allows an attacker to change the product's expected behavior and potentially load a third-party library upon execution. This issue…

more

affects Total Security: 27.0.25.114; Internet Security: 27.0.25.114; Antivirus Plus: 27.0.25.114; Antivirus Free: 27.0.25.114.

CWE(s)
CWE-15CWE-610

Related Threats

MITRE ATT&CK Enterprise Techniques

T1547.004 Winlogon Helper DLL Persistence
Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
attack.mitre.org →
T1574.006 Dynamic Linker Hijacking Stealth
Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries.
attack.mitre.org →
T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-7073Same product: Bitdefender Antivirus
CVE-2023-49570Same product: Bitdefender Total Security
CVE-2023-6055Same product: Bitdefender Total Security
CVE-2023-6057Same product: Bitdefender Total Security
CVE-2023-6056Same product: Bitdefender Total Security
CVE-2023-49567Same product: Bitdefender Total Security
CVE-2023-6058Same product: Bitdefender Total Security
CVE-2023-32076Shared CWE-15, CWE-610
CVE-2026-30816Shared CWE-15, CWE-610
CVE-2023-4704Shared CWE-15, CWE-610

Affected Assets

bitdefender
antivirus
27.0.25.114
bitdefender
antivirus plus
27.0.25.114
bitdefender
internet security
27.0.25.114
bitdefender
total security
27.0.25.114

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 4 hardening rules · 2 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforces approved authorizations for logical access to configuration resources so external parties cannot alter them.

CM-5 Access Restrictions for Change good match

Enforces documented access restrictions on all changes to system configuration, directly blocking unauthorized external control of settings.

AC-4 Information Flow Enforcement good match

Controls information flow between security domains, blocking resolution of external references to unintended spheres.

AC-6 Least Privilege good match

Limits privileges to the minimum needed, reducing the set of users who can externally modify configuration.

SI-10 Information Input Validation good match

Validates information inputs, directly stopping externally controlled names or references from being accepted.

SC-7 Boundary Protection partial match

Monitors and controls boundary communications, limiting the ability of external references to reach protected resources.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

ID.RA-07 partial match
blocks

Formal change and exception management catches externally driven configuration alterations.

PR.AA-05 partial match
blocks

Least-privilege access policies reduce unauthorized external modification of configuration values.

PR.PS-01 partial match
blocks

Hardened configuration baselines and change controls directly limit external manipulation of settings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.15 Access control partial match
blocks

A.5.15 only requires that access control policies and rules be defined and documented; it does not itself enforce, implement or configure those rules to stop external control of system/configuration settings, so the weakness remains fully exploitable.

A.5.18 Access rights partial match
blocks

A.5.18 governs the provisioning, review, and revocation of authorized access rights; it has no bearing on whether a system or configuration setting can be externally controlled by a user (CWE-15).

A.5.37 Documented operating procedures partial match
degrades

Documented operating procedures define how configuration changes must be performed.

A.8.18 Use of privileged utility programs partial match
blocks

Use of privileged utility programs is controlled to prevent misuse of configuration tools.

A.8.19 Installation of software on operational systems partial match
removes
A.8.2 Privileged access rights partial match
blocks

Privileged access rights reduce the number of users who can alter configuration.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-610, a class-level weakness, and none of its children carries one either.

References