Local Privilege Escalation in K7 Ultimate Security by K7 Computing
CVE-2019-16896

7.8HIGH

Key Information:

Vendor

K7computing

Status
K7 Ultimate Security
Vendor
CVE Published:
27 December 2019

What is CVE-2019-16896?

In K7 Ultimate Security version 16.0.0117, a vulnerability exists within the K7BKCExt.dll backup module. This issue arises from improper validation of administrative privileges, enabling a malicious actor to execute a symbolic link attack. Such an attack can allow unauthorized users to overwrite arbitrary files through the file restoration feature, potentially leading to a broad range of security risks.

References

https://support.k7computing.com/index.php?/selfhelp/categ...
x_refsource_MISC
https://github.com/NtRaiseHardError/Antimalware-Research/...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-16896 : Local Privilege Escalation in K7 Ultimate Security by K7 Computing