DriveLock
CVE-2025-67781
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as unprivileged local user
-
ExploitManipulate privileged DriveLock process
-
ExecutionExecute actions in elevated context
-
ImpactGain full administrative/SYSTEM control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have an interactive, authenticated session as a local unprivileged user on a Windows host running a vulnerable DriveLock agent (24.1 before 24.1.6, 24.2 before 24.2.7, or 25.1 before 25.1.5). Exploitation depends on the presence of DriveLock's privileged process/service, which the unprivileged user manipulates to escalate; no network reachability, no victim user interaction, and no prior administrative rights are needed. Limiting factors: this is purely local - remote or unauthenticated exploitation is not supported by the described mechanism - so exposure is confined to endpoints where untrusted or semi-trusted local users have login access. |
| Impact | This is a CWE-269 (Improper Privilege Management) local privilege escalation in DriveLock endpoint-security agents, carrying a published CVSS 9.9. A critical signal conflict exists: the published CVSS vector declares AV:N (network) with S:C (scope change), which is what inflates the score to 9.9, yet the description explicitly states 'Local unprivileged users' manipulating privileged processes - a textbook local EoP. The AV:N label is almost certainly incorrect; corrected to AV:L the real base score is ~7.8 (High, not Critical) - VERIFY WITH VENDOR. No EPSS score, CISA KEV listing, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis'. Net real-world risk: a genuine, meaningful local EoP that lets any authenticated low-privileged user on an endpoint escalate to full control, but it is NOT a remotely exploitable, mass-scannable issue and should be prioritized as a High-severity patch for endpoints where untrusted local users operate, not as an internet-facing Critical. |
| Exploit ScenarioDerived | A low-privileged but authenticated user on a Windows workstation running a vulnerable DriveLock agent locally abuses a privileged DriveLock process (e.g., manipulating how the elevated service handles input or operations) to execute code or actions in that process's high-privilege context, escalating to SYSTEM/administrator. No public exploit code was identified in the provided data, and local access to the machine as an existing user is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in the DriveLock Windows endpoint agent (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5) allows an authenticated but unprivileged local user to manipulate the product's privileged processes and obtain elevated rights, up to full administrative control of the host. The published CVSS 9.9 reflects a network-vector, scope-changed interpretation, whereas independent assessment scores the flaw as a local, scope-unchanged escalation (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming exploitation requires an existing interactive session on the Windows endpoint and is neither remote nor unauthenticated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was provided, but a full local-to-SYSTEM/administrator escalation in an endpoint-security agent is a high-value post-compromise target across managed fleets.
RemediationAI
Vendor-released patches exist: upgrade DriveLock agents to 24.1.6 or later on the 24.1 branch, 24.2.7 or later on the 24.2 branch, and 25.1.5 or later on the 25.1 branch, and verify the deployed agent version on every Windows endpoint through the management console rather than relying on installer inventories. Until patched endpoints are confirmed, compensating controls are limited because the exploitable surface runs as a trusted local service: restrict interactive logon on affected hosts to fully trusted users (trade-off is reduced workstation sharing and possible operational friction for shift or kiosk staff), remove unnecessary local administrator and power-user assignments for standard accounts (trade-off is increased helpdesk load for legitimate elevation), and enable application allowlisting plus service/ACL hardening and monitoring for anomalous token elevation, unexpected child processes of DriveLock services, and privilege-related Windows event IDs (trade-off is tuning overhead and possible false positives). Reference the vendor portal at https://drivelock.help/en-us/Content/Home.htm for the authoritative build guidance, and treat any endpoint still running a pre-fix DriveLock build as a candidate for isolation or temporary agent removal if local untrusted users must retain logon access.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-269 Improper Privilege Management issue in DriveLock, a commercial Windows endpoint security and management agent. The mechanism class covers privileged processes or services that implicitly trust input, handles, IPC objects (named pipes, ALPC, shared memory), file/registry paths, or service configuration reachable by a low-privileged interactive user; by manipulating that privileged component, the unprivileged attacker causes code or operations to execute in a higher-integrity context. Because the affected component runs with administrative privileges as part of the agent's protection/management role, a successful primitive yields host-wide compromise rather than mere user-level access. CPE entries (cpe:2.3:a:drivelock:drivelock) enumerate the three affected release trains 24.1, 24.2, and 25.1. The description does not disclose which specific IPC or service primitive is at fault, so defenders should treat any privileged surface exposed by the agent to local users as suspect until the fixed build is applied. The CWE class and the CVSS PR:L/AV:L assessment together indicate that the attacker must already hold valid local credentials and an interactive logon; there is no supported remote or pre-authentication vector in the stated mechanism.
Know when Drivelock gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Description states local unprivileged users escalate privileges, so AV:L and PR:L with no user interaction; full SYSTEM compromise gives C/I/A:H, and scope is unchanged for a same-host EoP.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged processes to gain more privileges on Windows computers.
Executive ViewAI
DriveLock Windows endpoint agent versions 24.1, 24.2, and 25.1 (prior to 24.1.6, 24.2.7, and 25.1.5) contain a local privilege escalation flaw allowing any authenticated local user to gain administrative control of the host. This puts managed Windows fleets at risk of full endpoint compromise, undermining the security agent itself and enabling lateral movement, data theft, or ransomware deployment. Leadership should prioritize remediation because a compromised endpoint security agent can blind security monitoring and grant attackers persistent privileged access across the organization.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting interactive logon to trusted users, enforcing least privilege, removing unnecessary local accounts, enabling auditing for privilege escalation, and application allowlisting. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
DriveLock tenants whose agent-authentication configuration is incomplete can be attacked by unauthenticated remote actor
Privilege escalation in DriveLock allows an authenticated user who holds the 'Manage roles and permissions' privilege to
Cross-site scripting in the DriveLock Operations Center web console (versions 25.1.2 through 25.1.4) lets an attacker in
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protect
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets re
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arb
Local privilege escalation in DriveLock endpoint-security agents (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 befor
Unprivileged local users on Windows hosts running affected DriveLock builds (24.1 before 24.1.6, 24.2 before 24.2.7, and
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authen
Incorrect permission assignments on directories and files created by the DriveLock endpoint agent let any local non-admi
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read
Cross-tenant information disclosure in DriveLock 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5) al
GitHub PoC
Exploit-DB