Vulnerability Details : CVE-2019-16897
In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through 16.0.0120, the module K7TSHlpr.dll improperly validates the administrative privileges of the user, allowing arbitrary registry writes in the K7AVOptn.dll module to facilitate escalation of privileges via inter-process communication with a service process.
Products affected by CVE-2019-16897
- K7computing » K7 Antivirus PremiumVersions from including (>=) 16.0.000 and up to, including, (<=) 16.0.0120cpe:2.3:a:k7computing:k7_antivirus_premium:*:*:*:*:*:*:*:*
- K7computing » K7 Total SecurityVersions from including (>=) 16.0.000 and up to, including, (<=) 16.0.0120cpe:2.3:a:k7computing:k7_total_security:*:*:*:*:*:*:*:*
- K7computing » K7 Ultimate SecurityVersions from including (>=) 16.0.000 and up to, including, (<=) 16.0.0120cpe:2.3:a:k7computing:k7_ultimate_security:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-16897
0.66%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 77 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-16897
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2019-16897
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-16897
-
https://github.com/NtRaiseHardError/Antimalware-Research/blob/master/K7%20Security/Local%20Privilege%20Escalation/v16.0.0120/README.md
Antimalware-Research/README.md at master · NtRaiseHardError/Antimalware-Research · GitHubExploit;Third Party Advisory
Jump to