Medium severity · published Dec 2, 2019
CVE-2019-15689
Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E have bug that allows a local user to…
6.7
CVSS
0.8%
EPSS
No
On KEV
Description
Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud prior to version 2020 patch E have bug that allows a local user to execute arbitrary code via execution compromised file placed by an attacker with administrator rights. No privilege escalation. Possible whitelisting bypass some of the security products
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
Kaspersky Internet Security · Kaspersky
2019; 2019; 2019; 2019 · source: NVD
SC
Secure Connection · Kaspersky
3.0; 4.0 · source: NVD
SC
Security Cloud · Kaspersky
2019; 2019; 2019; 2020 · source: NVD
TS
Total Security · Kaspersky
2019; 2019; 2019; 2019; 2020 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-15689
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-15689
Broken Link
https://support.kaspersky.com/general/vulnerability.aspx?el=12430#021219
Exploit
https://safebreach.com/Post/Kaspersky-Secure-Connection-DLL-Preloading-and-Potential-Abuses-CVE-2019-15689
Third Party Advisory
https://www.symantec.com/security-center/vulnerabilities/writeup/111033
More from Kaspersky Internet Security
–
CVE-2014-5654
The Kaspersky Internet Security (aka com.kms.free) application 11.4.4.232 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers…
–
CVE-2009-2966
avp.exe in Kaspersky Internet Security 9.0.0.459 and Anti-Virus 9.0.0.463 allows remote attackers to cause a denial of service (CPU consumption and network connectivity loss) via…
–
CVE-2009-2647
Unspecified vulnerability in Kaspersky Anti-Virus 2010 and Kaspersky Internet Security 2010 before Critical Fix 9.0.0.463 allows remote attackers to disable the Kaspersky…
–
CVE-2006-3074
klif.sys in Kaspersky Internet Security 6.0 and 7.0, Kaspersky Anti-Virus (KAV) 6.0 and 7.0, KAV 6.0 for Windows Workstations, and KAV 6.0 for Windows Servers does not validate…