CVE-2014-5350: Bitdefender GravityZone directory traversal in Web Console and Update Server

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote file read with public exploit references and very high EPSS, though impact is limited to confidentiality and a fixed version exists.

What it is

Bitdefender GravityZone before 5.1.11.432 contains multiple directory traversal flaws. An unauthenticated remote attacker can supply dot-dot sequences in the id parameter of the Web Console download endpoint or in the default URI on Update Server port 7074 to read arbitrary files. Because the affected components are management and update services, exposed instances risk leaking configuration and credential material.

Impact

An attacker gains read access to arbitrary files on the GravityZone host, which can expose configuration, credentials or other sensitive data. There is no write or code execution impact described in the record.

Attack surface

Reachable over the network via HTTP requests to the Web Console download endpoint and to port 7074 on the Update Server. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.64 (99th percentile) and multiple references are tagged Exploit, indicating public exploit material exists. No ransomware usage is documented.

What to do

• Upgrade GravityZone to 5.1.11.432 or later, which the advisory names as the fixed build.
• Restrict network access to the Web Console and to Update Server port 7074 using firewall rules, as Bitdefender's own guidance suggests.
• Do not expose the management console or update service directly to untrusted networks; place them behind VPN or administrative segmentation.
• After patching, rotate any credentials or secrets that may have been stored in files readable through the traversal.

Detection

• Search web and update server logs for requests containing '..' or '%2E%2E' in the URI or id parameter.
• Alert on access to the webservice/CORE/downloadFullKitEpc path with unexpected id values.
• Monitor port 7074 for requests with encoded traversal sequences from external or unusual source addresses.
• Review outbound or file-read behavior from the GravityZone host for signs of configuration file access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.