Drivelock
CVE-2025-55187
CRITICAL
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges.
AnalysisAI
In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges. Affected products include: Drivelock. Version information: before 24.1.5.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protect
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets re
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arb
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authen
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today