CVE-2017-18019

Severity: high (CVSS 7.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-01-04 · updated 2026-06-17
Weakness: CWE-20

Description

In K7 Total Security before 15.1.0.305, user-controlled input to the K7Sentry device is not sufficiently sanitized: the user-controlled input can be used to compare an arbitrary memory address with a fixed value, which in turn can be used to read the contents of arbitrary memory. Similarly, the product crashes upon a \\.\K7Sentry DeviceIoControl call with an invalid kernel pointer.

Affected products

K7Computing Total Security: before 15.1.0.305 — fixed in 15.1.0.305

How to fix

Upgrade to a fixed version: K7Computing Total Security 15.1.0.305. Check the vendor advisory for mitigations.

References

https://blogs.securiteam.com/index.php/archives/3435
https://blogs.securiteam.com/index.php/archives/3435

Get alerted when CVE-2017-18019 or the next vulnerability affects your stack