CVE-2022-0357: 
Bitdefender Internet Security vulnerability analysis and mitigation

Unquoted Search Path or Element vulnerability (CVE-2022-0357) was discovered in the Vulnerability Scan component of Bitdefender security products. The vulnerability affects Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus versions prior to 26.0.10.45. This security issue was disclosed on May 24, 2023 (Vendor Advisory).

The vulnerability is classified as an Unquoted Search Path or Element vulnerability (CWE-428). It received a CVSS v3.1 base score of 7.8 HIGH from NIST (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while Bitdefender assigned it a score of 6.7 MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The vulnerability requires local access with low attack complexity (NVD).

If exploited, this vulnerability allows an attacker to elevate privileges to SYSTEM level, potentially gaining complete control over the affected system (Vendor Advisory).

The vulnerability requires local access to the system and low privileges to exploit. No public exploits or active exploitation in the wild have been reported (NVD).

Bitdefender has addressed this vulnerability in version 26.0.10.45 of the affected products. Users should ensure their Bitdefender products are updated to version 26.0.10.45 or higher (Vendor Advisory).