CVE-2019-16896: k7computing k7_ultimate_security Link Following

Vulnerability summary

CVE-2019-16896 is a high (CVSS 7.8) Link Following vulnerability in k7computing k7_ultimate_security. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-12-2019
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

In K7 Ultimate Security 16.0.0117, the module K7BKCExt.dll (aka the backup module) improperly validates the administrative privileges of the user, allowing an arbitrary file write via a symbolic link attack with file restoration functionality.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.