K7 Antivirus Vulnerability Allows Attackers Gain SYSTEM-level Privileges
A privilege escalation vulnerability has been identified in K7 Ultimate Security, an antivirus solution by K7 Computing. This vulnerability leverages named pipes with overly permissive access control lists to allow low-privileged users to manipulate…
A privilege escalation vulnerability has been identified in K7 Ultimate Security, an antivirus solution by K7 Computing. This vulnerability leverages named pipes with overly permissive access control lists to allow low-privileged users to manipulate registry settings and obtain SYSTEM-level access without triggering UAC prompts.
The issue was discovered by security researcher Lucas Laise from Quarkslab during the investigation of an unrelated denial-of-service vulnerability, CVE-2024-36424 , affecting K7RKScan.sys in versions prior to 17.0.2019.
Initial tests on version 17.0.2045 showed limited functionality for non-admin users, who could not modify configurations without elevation. However, administrators could allow non-admin users to change settings and disable protection without UAC prompts, indicating potential inter-process communication flaws. Tools identified SYSTEM-owned named pipes such as \.\pipe\K7MailProxyV1 with full permissions and \.\pipe\K7TSMngrService1, used by K7TSMain.exe for registry modifications.
Captured binary payloads sent to K7TSMngrService1 during setting changes were confirmed, allowing exploitation where low-privilege processes could impersonate legitimate requests.
A privilege escalation vulnerability has been identified in K7 Ultimate Security, an antivirus solution by K7 Computing.
Attackers could replay captured packets via PowerShell to enable configuration tampering, potentially disabling real-time scans or whitelisting malware. Further exploitation involved manipulating the registry key AdminNonAdminIsValid to inject arbitrary values, bypassing validation.
Researchers achieved full local privilege escalation by exploiting Image File Execution Options (MITRE ATT&CK T1546.012), allowing arbitrary code execution as SYSTEM during fake updates. A script was provided to create batch files for new admin users, trigger updates, and clean up.
K7 Computing released three patches. The first added caller validation on K7TSMngrService1, which was bypassed via manual DLL mapping. The second patch, using the K7Sentry.sys driver version 22.0.0.70, blocked injection into protected processes, but could be circumvented with renamed signed K7 binaries outside protected lists.
Security checks in IDA Pro revealed validation processes for installation paths, MD5 hashes, and K7 signatures. Bypasses relied on unsigned or relocated signed binaries, evading pipe access and protection hooks.
The responsible disclosure process spanned from August to December 2025, with Quarkslab notifying K7 on August 25. K7 published the findings on December 2 after bypass confirmations, and plans to enforce full ACL in a future major release. Users are advised to update to the latest versions and monitor for comprehensive remediation. Exploit scripts are available on the Quarkslab blog for defensive analysis.
Based on reporting by Cyber Security News.