CVE-2017-9812

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.07.5High EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 4 sources FixVendor fixNo build named by the sources

Published 2017-07-17Updated 2026-05-13Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Kaspersky Anti-Virus for Linux File Server version is before “Maintenance Pack 2 Critical Fix 4 (8.0.4.312)”.
Check whether the product’s web interface is reachable from outside your network (for example, accessible from the internet or from untrusted networks).
If it is reachable or you’re unsure, immediately restrict access to the web interface to only trusted IPs or internal networks.
Upgrade/apply the fix to Maintenance Pack 2 Critical Fix 4 (8.0.4.312) or later, following your vendor’s upgrade guidance.
After upgrading, monitor for unusual web requests to the getReportStatus area and review logs for abnormal attempts to access report/status endpoints.

Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312) to read arbitrary files with kluser privileges.

In plain language

Written by AI from the record

This bug in Kaspersky Anti-Virus for Linux File Server lets an attacker use the web interface to read any file on the server without a login, so you should treat it as an active security risk if you expose the web interface to the internet.

Unauthenticated network abuse of the Kaspersky Anti-Virus for Linux File Server web interface allows attackers to manipulate the reportId parameter in the getReportStatus action method to read arbitrary files with limited server privileges.

If you're affected

Confidential files exposed
Credentials or sensitive data theft
Service disruption risk
Regulatory exposure

What is it

Imagine a guard at your office who should only hand out the “status reports,” but a missing check lets someone ask for any document instead. With this bug, someone can reach the antivirus server’s web page and trick it into revealing files from the server, even without logging in. The danger is that the exposed files can include sensitive information stored on that machine.

Who is affected

This matters if you run Kaspersky Anti-Virus for Linux File Server and it has its web interface accessible on a network (especially if it’s reachable from the internet). The vulnerability does not require authentication and can be triggered remotely, so it’s relevant even if you don’t share accounts or user credentials. The risk is highest when the web interface is reachable from untrusted networks, including the public internet.

How urgent is it

This should be treated as urgent because the issue allows remote attackers to read arbitrary files with limited privileges and it is publicly exploit-able. The findings also indicate public exploit code exists, and the exposure is reachable in the default configuration, which increases the chance of real-world attempts. Given the AMBER verdict, prioritize checking exposure and applying the fixed version without delay.

What to do — in detail

Confirm whether you’re exposed

Identify your installed version of Kaspersky Anti-Virus for Linux File Server.
- You’re exposed if your version is before Maintenance Pack 2 Critical Fix 4 (8.0.4.312).
Verify network exposure of the web interface.
- Determine whether the product’s web UI is reachable from:
  - the internet, or
  - any untrusted networks.
- Also confirm firewall rules allow inbound access to the web UI ports from outside trusted IP ranges.

Remediate

Upgrade to the fixed version.
- Apply Maintenance Pack 2 Critical Fix 4 (8.0.4.312) or later per your vendor’s upgrade path.
- After upgrading, re-check the version to ensure the fix is actually installed.
If you can’t upgrade immediately (workaround)
- Restrict access to the web interface so only trusted internal IPs can reach it (or shut down external access entirely).
- Ensure inbound firewall rules do not allow web UI access from the internet.

After patching

Look for suspicious activity
- Review server/web access logs for unusual requests targeting the report/status functionality (notably patterns consistent with getReportStatus).
- Pay attention to repeated requests and requests with unusual reportId-like values.

Timeline

Follow up promptly
- No KEV listing was provided, so a strict KEV-only deadline isn’t known from these findings. Still, use the AMBER urgency to schedule upgrade immediately and complete exposure restriction as soon as possible.

What to monitor going forward

Ongoing attempts to access the web interface from unexpected IPs, especially if the interface should only be internal.
Any error spikes or repeated access to the same endpoint shortly before/after external scanning activity.

Technical context

What’s happening

Weakness type: CWE-200 (information exposure).
Mechanism: The reportId parameter in the web action method getReportStatus can be abused to cause the server to read arbitrary files using the antivirus service’s limited privileges (not full root implied, but still capable of accessing confidential data).

Exposure details from findings

Authentication required: False.
Network attack vector: Remote over the network.
No user interaction required.
Reachable in default config: Yes.
Impact described: Read any file on the server with limited user permissions.

Exploitability status

A public exploit is available (4 known).
KEV: Not listed in CISA KEV (so no KEV-driven deadline is known from the findings).
Exploit likelihood prediction: Provided as an EPSS prediction with a falling trend, but this is not used to justify urgency over confirmed exploit availability.

Practical risk for owners

If your web interface is reachable from untrusted networks, attackers can potentially retrieve sensitive files directly by crafting requests to the affected endpoint/parameter.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

4 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

A public exploit existed 67 days before the patch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band changelow → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

АО «Лаборатория Касперского»commercial · RUaka ao laboratoriya kasperskogo, kaspersky
- Kaspersky Anti-Virus for Linux File ServerOn-premSecurity Products / endpoint-av-edr
kasperskycommercial · RUaka kaspersky antivirus, kaspersky lab
- anti-virus for linux serverSecurity Products

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact