CVE-2025-1055

Think of your antivirus as a guard stationed at your office door with special authority to stop threats. This flaw lets any regular employee - not just an administrator - tell that guard (or other important office processes) to shut down, even though they shouldn't have that power. The result isn't data theft, but your protection or other key software can be switched off or crash, leaving the business temporarily unprotected or disrupted.

This matters to you if you run K7 Security Anti-Malware on any Windows computers in your business. It applies to versions before 23.0.0.10. This is only a risk if an attacker or malicious insider already has some form of login access to the machine - it cannot be triggered remotely over the internet.

This vulnerability is attracting sustained security research attention, including scrutiny tied to the DragonForce threat actor, which signals real interest in weaponizing it even though no confirmed in-the-wild attacks or public exploit code exist yet. Because a fix is already available and the flaw can be used to blind your security software, treat this as something to act on now rather than wait and see.

1. Inventory all Windows hosts running K7 Security Anti-Malware and record the installed version.
2. Any version prior to 23.0.0.10 is vulnerable; prioritize servers and endpoints with multiple local user accounts or shared/terminal-services access, since exploitation requires local code execution with low-privilege credentials.
3. Upgrade to 23.0.0.10 or later via K7's standard update channel; no breaking changes are indicated in the findings, so this should be a straightforward driver/agent update followed by a reboot to load the patched K7RKScan.sys.
4. If immediate patching isn't possible, restrict local logon rights and remove unnecessary local accounts on hosts running the affected driver to reduce the pool of users who could send the malicious IOCTL requests.
5. There is no CISA KEV listing and no due date mandate for this CVE; prioritization should be driven by internal risk tolerance and the sustained research attention noted around it.
6. Monitor for unexpected termination of security or administrative processes on endpoints as a possible indicator of attempted exploitation, and confirm the driver version post-update via the K7 management console or file version check on K7RKScan.sys.

CVSS 3.1 score 5.6 (Medium), vector AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H - local attack vector, high attack complexity, low privileges required, no user interaction, changed scope, no confidentiality/integrity impact but high availability impact. Weakness is CWE-862 (Missing Authorization) in the kernel-mode driver's IOCTL handler, allowing an unprivileged local process to instruct the driver to terminate arbitrary non-protected privileged processes. Not listed in CISA KEV; no public exploit code is on record; EPSS places predicted exploitation likelihood in the low percentile with a flat trend. Press/research attention is sustained and associated with scrutiny from the DragonForce actor, though this reflects research interest, not confirmed exploitation. Fixed in K7 Security Anti-Malware 23.0.0.10.