CVE-2025-67826

{
  "id": "CVE-2025-67826",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-22T15:16:00.550",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE) vulnerability in the K7 Ultimate Security antivirus can be exploited by a local unprivileged user on default installations of the product. Insecure access to a named pipe allows unprivileged users to edit any registry key, leading to a full compromise as SYSTEM."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en K7 Ultimate Security 17.0.2045. Una vulnerabilidad de escalada de privilegios local (LPE) en el antivirus K7 Ultimate Security puede ser explotada por un usuario local sin privilegios en instalaciones predeterminadas del producto. El acceso inseguro a una tubería con nombre permite a los usuarios sin privilegios editar cualquier clave de registro, lo que lleva a un compromiso total como SYSTEM."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-22T16:18:00.369194Z",
          "id": "CVE-2025-67826",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:k7computing:k7_ultimate_security:17.0.2045:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9802D59-B770-4F24-BE08-778A2F8BEA1F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.k7computing.com/index.php?/selfhelp/view-article/Advisory-issued-on-22nd-Dec-2025",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.k7computing.com/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}