CVE-2023-6057 is a high severity (CVSS 7.4 in the record) flaw in Bitdefender Total Security HTTPS scanning. The product did not properly check the certificate chain for certificates issued with the DSA signature algorithm, which allows man-in-the-middle connections to arbitrary sites. Bitdefender says an automatic update to 27.0.25.115 fixes it.
What's affected
- Product: Bitdefender Total Security, HTTPS scanning feature.
- Affected: versions before 27.0.25.115.
- Fixed: 27.0.25.115, delivered by automatic update, per advisory VA-11166.
- Severity: the NVD record says 7.4 High. Bitdefender scores it 8.6 using CVSS 4.0, a different scoring system.
- Published: Bitdefender advisory dated 18 October 2024.
How to check if you're exposed
Open Bitdefender, find the version under About or Settings, and confirm it reads 27.0.25.115 or later. If it does not, run a manual update and check again.
For a managed fleet, list the installed Bitdefender Total Security versions from your endpoint inventory. Ask people who use the product on personal devices for work to confirm theirs.
What to do now
- Update Bitdefender Total Security so it reports 27.0.25.115 or later.
- Keep automatic product updates switched on.
- Avoid public or untrusted networks on machines you have not confirmed.
- Decide with your security team whether HTTPS scanning is worth keeping on.
- Record the version in your inventory.
Why it matters
A certificate chain proves that a site's certificate was issued by an authority your system trusts. The record says that for certificates issued using the DSA signature algorithm, the product did not check that chain properly. An attacker could mint a certificate signed with DSA for any site and the product would accept it. The record lists CWE-295, improper certificate validation.
This is the third of three related advisories from Bitdefender on the same feature, each covering a different gap in validation: the Extended Key Usage field, RIPEMD-160 signatures and DSA signatures. All three are fixed in 27.0.25.115. They share the same requirement that the attacker is on the network path. The record does not list this CVE as known exploited.
If you want to confirm the fix on a test machine, update the product, then browse to a few ordinary HTTPS sites and check that pages load normally and that no certificate warnings appear. A normal result does not prove the flaw is gone. The version number is the evidence to rely on, and Bitdefender names 27.0.25.115 as the fixed build.
It also helps to note when each machine last updated. Machines that have not talked to the update service for weeks are the ones most likely to still carry the old build, and they are often laptops that travel and join untrusted networks, which is where this class of attack is most realistic.
DSA certificates are uncommon on the public web today, so ordinary browsing rarely meets them. An attacker who wants to use one has to arrange to be on your path, which narrows who can act on this flaw to people near the victim or in control of a network hop.
Quick check
Are these three CVEs fixed together?
Yes. The three Bitdefender advisories each name the automatic update to 27.0.25.115 as the fix, so one updated version covers all three.
Sources
Last reviewed: 19 October 2026.
