Lucene search

[email protected]CVE-2019-16897

HistoryOct 28, 2019 - 3:15 p.m.

CVE-2019-16897

2019-10-2815:15:14

CWE-269

[email protected]

web.nvd.nist.gov

cve-2019-16897

k7 antivirus

privilege escalation

vulnerability

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.7%

JSON

In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through 16.0.0120, the module K7TSHlpr.dll improperly validates the administrative privileges of the user, allowing arbitrary registry writes in the K7AVOptn.dll module to facilitate escalation of privileges via inter-process communication with a service process.

Affected configurations

NVD

Node

k7computingk7_antivirus_premiumRange16.0.000–16.0.0120

k7computingk7_total_securityRange16.0.000–16.0.0120

k7computingk7_ultimate_securityRange16.0.000–16.0.0120

CPENameOperatorVersion
k7computing:k7_antivirus_premiumk7computing k7 antivirus premiumle16.0.0120
k7computing:k7_total_securityk7computing k7 total securityle16.0.0120
k7computing:k7_ultimate_securityk7computing k7 ultimate securityle16.0.0120

CPE	Name	Operator	Version
k7computing:k7_antivirus_premium	k7computing k7 antivirus premium	le	16.0.0120
k7computing:k7_total_security	k7computing k7 total security	le	16.0.0120
k7computing:k7_ultimate_security	k7computing k7 ultimate security	le	16.0.0120

References

github.com/NtRaiseHardError/Antimalware-Research/blob/master/K7%20Security/Local%20Privilege%20Escalation/v16.0.0120/README.md

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.5 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

79.7%

JSON

Related for CVE-2019-16897

prion1 cvelist1 nvd2 cve1