CVE-2023-6056 is a high severity (CVSS 7.4 in the record) flaw in Bitdefender Total Security HTTPS scanning. The product trusted certificates signed with the RIPEMD-160 hash without proper validation, which allows man-in-the-middle connections to arbitrary sites. Bitdefender says an automatic update to 27.0.25.115 fixes it.
What's affected
- Product: Bitdefender Total Security, HTTPS scanning feature.
- Affected: versions before 27.0.25.115.
- Fixed: 27.0.25.115, delivered by automatic update, per advisory VA-11164.
- Severity: the NVD record says 7.4 High. Bitdefender scores it 8.6 using CVSS 4.0. The two numbers come from different scoring systems.
- Published: Bitdefender advisory dated 18 October 2024.
How to check if you're exposed
Open Bitdefender and read the product version in the About page or settings. Anything below 27.0.25.115 needs the update. Because Bitdefender delivers the fix automatically, the quickest check is to confirm that the product reports the newer version after a manual update run.
For machines you manage, pull the installed version of Bitdefender Total Security from your endpoint inventory and list any that are behind. Personal laptops that handle work email deserve a quick check too.
What to do now
- Run a product update and confirm the version is 27.0.25.115 or later.
- Leave automatic updates enabled for the product.
- Stay off untrusted networks on machines that are not yet updated.
- Review whether HTTPS scanning is needed in your environment, and decide with your security team.
- Note the version in your asset records.
Why it matters
When HTTPS scanning is on, the security product validates the website's certificate chain for you. A flaw in that validation means a bad certificate can be accepted. Here, certificates that use RIPEMD-160 as their signature hash were trusted without proper verification. The record lists CWE-295, improper certificate validation.
An attacker who can sit between the victim and the site, such as on a shared Wi-Fi network, could present such a certificate and the product would pass it on as trustworthy. The user would see no warning because the product re-encrypts the traffic with its own certificate. That is the quiet danger of validation bugs in inspection tools. The record does not list this CVE as known exploited. Bitdefender fixed this alongside CVE-2023-6055 and CVE-2023-6057 in the same version.
For teams that standardize on one security product, the lesson is about verification. Vendors ship fixes silently through automatic updates, and a fix you have not confirmed is only a promise. A quick audit of the version column in your inventory takes minutes, and it also surfaces machines that have quietly stopped updating for unrelated reasons.
RIPEMD-160 is a hash function that is rarely used for certificate signatures on the public web. A product that accepts it without proper validation is accepting something it has no good reason to treat as normal.
Quick check
Do I need to do anything if updates are automatic?
Check that the update happened. Machines that have been offline, or where updates were paused, can lag. Confirm the version number is 27.0.25.115 or later.
Sources
Last reviewed: 19 October 2026.
