CVE-2017-17429

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-16 · updated 2026-06-17
Weakness: CWE-20

Description

In K7 Antivirus Premium before 15.1.0.53, user-controlled input to the K7Sentry device is not sufficiently authenticated: a local user with a LOW integrity process can access a raw hard disk by sending a specific IOCTL.

Affected products

K7Computing Antivirus: before 15.1.0.53; before 15.1.0308 — fixed in 15.1.0.53, 15.1.0308
K7Computing Endpoint: before 14.2.0137 — fixed in 14.2.0137
K7Computing Internet Security: before 15.1.0297 — fixed in 15.1.0297
K7Computing Total Security: before 15.1.0324; before 16.0.0131 — fixed in 15.1.0324, 16.0.0131
K7Computing Ultimate Security: before 15.1.0324 — fixed in 15.1.0324

How to fix

Upgrade to a fixed version: K7Computing Antivirus 15.1.0.53, 15.1.0308; K7Computing Endpoint 14.2.0137; K7Computing Internet Security 15.1.0297; K7Computing Total Security 15.1.0324, 16.0.0131; K7Computing Ultimate Security 15.1.0324. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-17429 or the next vulnerability affects your stack