Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-52915. PoCs published by BlackSnufkin, diego-tella.
AI-analyzed exploit summary This repository contains functional exploit code for CVE-2025-52915, targeting vulnerabilities in K7 Ultimate Security’s `K7RKScan.sys` driver. The PoC supports both LPE (low-privilege abuse) and BYOVD (Bring Your Own Vulnerable Driver) modes, demonstrating process termination via crafted IOCTL calls.
Description
K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications.
Exploits (2)
This repository contains functional exploit code for CVE-2025-52915, targeting vulnerabilities in K7 Ultimate Security’s `K7RKScan.sys` driver. The PoC supports both LPE (low-privilege abuse) and BYOVD (Bring Your Own Vulnerable Driver) modes, demonstrating process termination via crafted IOCTL calls.
This repository contains a functional PoC exploit for CVE-2025-52915, leveraging the K7RKScan.sys driver's IOCTL 0x222018 to terminate arbitrary processes, demonstrated by killing MsMpEng.exe (Windows Defender). The exploit includes a C program that interacts with the vulnerable driver to achieve local privilege escalation (LPE) by abusing the driver's process termination functionality.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H