CVE-2025-7073

Executive Summary

CVE-2025-7073 is a local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241. The flaw allows a low-privileged attacker to achieve arbitrary file deletion and, through a chain of operations, arbitrary file copy and code execution as an elevated user. The root cause is the lack of symbolic link validation in bdservicehost.exe when deleting files from the user-writable directory C:/ProgramData/Atc/Feedback. This vulnerability has a CVSS score of 7.8 (High) and is currently patched. No public proof-of-concept or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a local privilege escalation in a Windows desktop security product (Bitdefender Total Security). No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high impact on confidentiality, integrity, and availability, combined with low attack complexity and no user interaction, makes this a serious local threat. An attacker with low privileges can fully compromise the system.

Deep Dive & Mechanics

The vulnerability resides in the bdservicehost.exe process, which runs with elevated privileges. It performs file deletion operations in the C:/ProgramData/Atc/Feedback directory, which is writable by low-privileged users. The service does not validate whether the target file is a symbolic link before deletion. An attacker can create a symbolic link in that directory pointing to a critical system file (e.g., C:/Windows/System32/config/SAM). When the service deletes the link, it deletes the target file, causing a denial of service or enabling further exploitation.

The attack chain involves three steps:

1. Arbitrary File Deletion: The attacker creates a symbolic link in the Feedback directory pointing to a target file. The service deletes it.
2. File Copy During Network Events: The service copies files from a source to a destination during network events. By manipulating the source or destination via symbolic links, the attacker can achieve arbitrary file copy.
3. Filter Driver Bypass via DLL Injection: The attacker injects a malicious DLL into a process that bypasses the filter driver, allowing the copied file (e.g., a malicious executable) to be executed with elevated privileges.

This chain enables the attacker to escalate from a low-privileged user to SYSTEM.

Vulnerable vs. Patched Code

The vulnerable code in bdservicehost.exe likely uses a function like DeleteFile() without checking if the path is a symbolic link. The patched version validates paths using GetFinalPathNameByHandle() or similar to resolve symbolic links and ensure the target is within an allowed directory.

Vulnerable Code (Conceptual):

void DeleteFeedbackFile(const std::wstring& filename) {
    std::wstring path = L"C:/ProgramData/Atc/Feedback/" + filename;
    DeleteFile(path.c_str()); // No symbolic link check
}

Patched Code (Conceptual):

void DeleteFeedbackFile(const std::wstring& filename) {
    std::wstring path = L"C:/ProgramData/Atc/Feedback/" + filename;
    HANDLE hFile = CreateFile(path.c_str(), DELETE, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
    if (hFile == INVALID_HANDLE_VALUE) return;
    wchar_t finalPath[MAX_PATH];
    GetFinalPathNameByHandle(hFile, finalPath, MAX_PATH, VOLUME_NAME_DOS);
    CloseHandle(hFile);
    if (wcsncmp(finalPath, L"C:/ProgramData/Atc/Feedback/", 30) != 0) {
        // Path traversal or symlink detected, abort
        return;
    }
    DeleteFile(path.c_str());
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows 10/11 with Bitdefender Total Security < 27.0.47.241
• Low-privileged user account

Steps:

1. Create a symbolic link in the Feedback directory:

   mklink C:\ProgramData\Atc\Feedback\target.txt C:\Windows\System32\config\SAM
   

2. Trigger the file deletion by causing a network event (e.g., connecting to a malicious server) that prompts bdservicehost.exe to delete files in the Feedback directory.
3. The SAM file is deleted, causing a denial of service or enabling further attacks.
4. For full privilege escalation, chain with file copy and DLL injection:
   • Create a symbolic link to a system executable (e.g., C:/Windows/System32/sethc.exe).
   • When the service copies a file during a network event, it overwrites the target with a malicious executable.
   • Inject a DLL into a process to bypass the filter driver and execute the malicious file.

Note: No public exploit code is available. This is a conceptual chain.

Blue Team

Detection:

• Monitor for symbolic link creation in C:/ProgramData/Atc/Feedback using Sysmon Event ID 1 (Process creation) with command line containing mklink.
• Monitor for file deletion events targeting critical system files (e.g., SAM, SYSTEM, security) using Windows Security Event ID 4663.
• Monitor for unusual file copy operations by bdservicehost.exe using Sysmon Event ID 11 (FileCreate).

Hunting:

• Search for processes creating symbolic links in C:/ProgramData/Atc/Feedback:

  DeviceProcessEvents
  | where ProcessCommandLine contains "mklink" and ProcessCommandLine contains "Atc/Feedback"
  

• Search for file deletion events with bdservicehost.exe as the process:

  DeviceFileEvents
  | where InitiatingProcessFileName == "bdservicehost.exe" and ActionType == "FileDeleted"
  

Indicators of Compromise (IOCs)

• File Paths:
  • C:/ProgramData/Atc/Feedback/* (any file in this directory)
  • C:/Windows/System32/config/SAM (if deleted)
  • C:/Windows/System32/sethc.exe (if replaced)
• Processes:
  • bdservicehost.exe (legitimate but abused)
  • cmd.exe or powershell.exe creating symbolic links
• Registry Keys:
  • HKLM\SYSTEM\CurrentControlSet\Services\Atc (Bitdefender service)
• Network Events:
  • Connections to attacker-controlled servers triggering file copy operations

Detection Engineering

YARA Rule

rule CVE_2025_7073_Symlink_Deletion {
    meta:
        description = "Detects symbolic link creation in Bitdefender Feedback directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7073"
    strings:
        $s1 = "C:/ProgramData/Atc/Feedback" nocase
        $s2 = "mklink" nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: CVE-2025-7073 - Symbolic Link Creation in Bitdefender Feedback Directory
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of symbolic links in the Bitdefender Feedback directory, indicating exploitation of CVE-2025-7073.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-7073
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'mklink'
            - 'C:/ProgramData/Atc/Feedback'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7073 - Potential Bitdefender Exploitation via Network Event"; flow:to_server; content:"|00 00 00 00|"; depth:4; sid:1000001; rev:1;)

Note: This is a placeholder rule. Actual network-based detection would require specific patterns from the file copy operation, which are not publicly documented.

Remediation & Mitigation

Immediate Actions:

1. Update Bitdefender Total Security to version 27.0.47.241 or later.
2. Restrict write access to C:/ProgramData/Atc/Feedback to only trusted users (e.g., SYSTEM and Administrators).
3. Enable Windows Defender Attack Surface Reduction (ASR) rules to block symbolic link creation from untrusted processes.

Long-Term Measures:

• Implement application whitelisting to prevent unauthorized executables.
• Monitor for file deletion events on critical system files.
• Conduct regular vulnerability scans and patch management.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.