CVE-2017-18019 EXPLOIT
7.1
HIGH · CVSS 3.0 · EPSS 1.2% (pctl 68)
Patch early
A public exploit exists.
Description
In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to compare an arbitrary memory address with a fixed value, which in turn can be used to read the contents of arbitrary memory. Similarly, the product crashes upon a \\.\K7Sentry DeviceIoControl call with an invalid kernel pointer.
Scoring
| CVSS | 7.1 (HIGH, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
| EPSS | 1.24% — more likely to be exploited than 68% of all CVEs |
| Weakness | CWE-20 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2018-01-04 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| k7computing | total security |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | K7 Total Security 15.1.0.305 - Device Driver Arbitrary Memory Read | 2017-10-23 |
References
→ the Explorer · watch your stack · NVD