CVE-2024-2223
Bitdefender Endpoint Security 7.0.5.200089 … 7.9.9.380
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-2223 is a high-severity Incorrect Regular Expression (CWE-185) vulnerability in Bitdefender Endpoint Security. Its CVSS base score is 8.1 (High).
Operationally, ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27179
Vulnerability Data
An Incorrect Regular Expression vulnerability in Bitdefender GravityZone Update Server allows an attacker to cause a Server Side Request Forgery and reconfigure the relay. This issue affects the following products that include the vulnerable component: Bitdefender Endpoint Security for Linux…
more
version 7.0.5.200089 Bitdefender Endpoint Security for Windows version 7.9.9.380 GravityZone Control Center (On Premises) version 6.36.1
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover regex that fails to match or compare data as intended.
A reference monitor must be small and correct, structurally limiting the chance of flawed comparison logic in authorization decisions.
Requiring documented development standards and tools reduces the chance that incorrect regular expressions are written into validation or filtering logic.
An SDLC that incorporates security can embed reviews or tooling that catch malformed regular expressions before deployment.
Security engineering principles require correct implementation of comparison logic used for access and authentication decisions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle includes validation of input-handling constructs such as regex.
A.8.26 only requires that security requirements (including input validation and resilience against injections) be identified and specified during development; it does not itself enforce, implement or assure any regex that would stop CWE-185 from being exploitable.
Secure architecture principles can require robust comparison mechanisms for access decisions.
Secure coding standards directly address proper construction and review of regular expressions.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-185, a class-level weakness, and none of its children carries one either.
- No fine-grained STIG row for CWE-697, a pillar-level weakness, and none of its children carries one either.