CVE-2025-5317 Improper access restriction to critical folder in Bitdefender Endpoint Security Tools for Mac
Local administrators can bypass uninstall password protection to remove Bitdefender Endpoint Security Tools for Mac without authorization.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5317?
CVE-2025-5317 is a medium-severity missing authorization vulnerability in Bitdefender Endpoint Security Tools for Mac, published on 11 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac (BEST) before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the application directory (/Applications/Endpoint Security for Mac.app/) and the related directories within /Library/Bitdefender/AVP without needing the uninstall password.
Weakness: CWE-862
Which versions are affected by CVE-2025-5317?
It affects 1 product.
Products include Bitdefender Endpoint Security.
How do I fix CVE-2025-5317?
No fix has been published for CVE-2025-5317 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-5317 being exploited?
There is no known exploitation of CVE-2025-5317 in the wild and no public exploit code.
Other vulnerabilities in Bitdefender Endpoint Security Tools for Mac
- CVE-2020-8108 Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759)
- CVE-2024-2223 Incorrect Regular Expression in GravityZone Update Server (VA-11465)
- CVE-2024-2224 Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)
- CVE-2020-8097 Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646)
Sources
Also known as GHSA-hpr3-4vvq-fj8x.