Bitdefender Total Security Vulnerability: HTTPS Scanning Flaw Allows MITM Attacks

CVE-2023-49570

What is CVE-2023-49570?

A vulnerability exists in Bitdefender Total Security's HTTPS scanning functionality that permits the software to incorrectly trust a certificate from an unauthorized issuer. This defect is rooted in the misinterpretation of the 'Basic Constraints' extension, where it suggests that a certificate is intended for 'End Entity' usage. As a result, an attacker could exploit this flaw to execute a Man-in-the-Middle (MITM) attack, allowing them to intercept and manipulate communications between users and secure websites, potentially compromising sensitive information.

References