High severity · published Aug 5, 2022
CVE-2022-27535
Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' feature by the…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' feature by the local authenticated attacker.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KV
Kaspersky VPN Secure Connection for Windows ·
prior to 21.6 · source: vendor
VS
Vpn Secure Connection · Kaspersky
before 21.6 · source: NVD
Affected product
KV
Kaspersky VPN Secure Connection for Windows
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-27535
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-27535
Vendor Advisory
https://forum.kaspersky.com/topic/kaspersky-statement-on-cve-2022-27535-26742/
Vendor Advisory
https://support.kaspersky.com/general/vulnerability.aspx?el=12430#050822
Third Party Advisory
https://www.synopsys.com/blogs/software-security/cyrc-advisory-kasperksy-vpn-microsoft-windows/