DriveLock Operations Center
CVE-2025-67787
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload
-
DeliveryDeliver to DriveLock Operations Center
-
ExploitOperator views injected content
-
ExecutionScript executes in admin browser
-
ImpactHijack authenticated session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated DriveLock Operations Center operator/administrator to view or interact with attacker-controlled content (UI:R) for the injected script to execute - the attacker themselves needs no credentials (PR:N) but cannot succeed without victim interaction. Exploitation is limited to environments running the DriveLock Operations Center web console at versions 25.1.2 through 25.1.4 (fixed in 25.1.5); the description does not state whether the XSS is stored or reflected, which affects how the payload must be delivered to the victim. |
| Impact | The CVSS 3.1 base score of 9.6 is driven by network attack vector, low complexity, no privileges (PR:N), a scope change (S:C) and high confidentiality/integrity impact from session takeover - but it is materially tempered by the UI:R requirement, meaning a victim must interact with attacker-controlled content for the XSS to fire. The multi-source signals argue AGAINST treating this as an urgent, mass-exploited threat: EPSS is only 0.26% (16th percentile), there is no CISA KEV listing, and no public proof-of-concept has been identified. This is a genuine, vendor-confirmed high-severity XSS in an administrative web console (session takeover of an operator would be serious), but the combination of required user interaction, low EPSS, absence of KEV/POC, and the niche deployment footprint of DriveLock places it in the 'high CVSS, moderate real-world urgency' category rather than a drop-everything priority. Note the A:L in the vendor vector is debatable for a pure XSS - a session-takeover XSS typically yields confidentiality/integrity impact but little direct availability effect; verify against the vendor bulletin. |
| Exploit ScenarioDerived | An attacker crafts malicious script content that is rendered by the DriveLock Operations Center web interface and lures or waits for an authenticated operator to view it; when the script executes in the operator's browser it steals the session, letting the attacker act as that administrator against the management console. Because the CVSS scope is changed (S:C), the impact extends beyond the vulnerable component into the victim's authenticated session. No public exploit code has been identified at time of analysis, so exploitation would require the attacker to develop the payload themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Cross-site scripting in the DriveLock Operations Center web console (versions 25.1.2 through 25.1.4) lets an attacker inject script that executes in the browser of an authenticated operator or administrator, enabling session takeover and full compromise of the hijacked console session. The attacker needs no credentials of their own (CVSS PR:N), but exploitation requires the victim to view or interact with attacker-controlled content (UI:R), and the scope change (S:C) plus high confidentiality and integrity impact are why the base score reaches 9.6 despite that interaction requirement. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV); EPSS is low at 0.26% (16th percentile), so the practical risk is concentrated in exposed DriveLock Operations Center deployments whose administrators can be lured into loading crafted content.
RemediationAI
Vendor-released patch: DriveLock Operations Center 25.1.5, which is the fixed release for this 25-002 Cross Site Scripting bulletin - upgrade all console deployments running 25.1.2 through 25.1.4 as the primary action, following the vendor guidance at https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-002-CrossSiteScripting.htm. If immediate upgrade is not possible, reduce exposure by restricting network reachability of the Operations Center console to trusted management networks or VPN only (trade-off: remote administration from other networks becomes unavailable), and by treating administrator browsing as a hostile surface - disabling or strictly controlling browser extensions, and enforcing an allowlist so operators cannot be lured to attacker-controlled pages while logged in. Applying a restrictive Content-Security-Policy and ensuring session cookies carry HttpOnly and SameSite attributes limits script-driven session theft but does not fix the underlying injection and may break console functionality if the policy is too strict. Because session takeover is the impact, also consider forcing re-authentication or invalidating existing console sessions after patching, and monitoring for anomalous administrative actions during the exposure window. No workaround in the available data fully substitutes for installing 25.1.5.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-79 improper neutralization of user-supplied input during web page generation, occurring in the DriveLock Operations Center administrative web console. Because the console handles authenticated sessions for endpoint-security management, successful script execution in an operator's browser context gives the attacker access to that session's tokens and privileges - the classic scope-change scenario (S:C) captured in the CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H. The provided CPE data pins the vulnerable builds to drivelock:drivelock 25.1.2 and 25.1.4, with the vendor bulletin indicating a fix in 25.1.5; versions between 25.1.2 and 25.1.5 are presumed affected. The available description does not state whether the XSS is stored or reflected, which determines the delivery path: a stored variant could persist in console content and fire when an administrator browses it, while a reflected variant requires the victim to click an attacker-crafted link or submit crafted input. Authentication requirements are confirmed from the CVSS vector as PR:N for the attacker - no credentials are needed on the attacker side - while the victim must be an authenticated console user who interacts with attacker-controlled content. The advisory, Driveloock Security Bulletin 25-002, is the authoritative source for the affected/fixed version boundary.
Know when Drivelock gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Network XSS needing operator interaction (UI:R) with cross-context session takeover (S:C, C:H/I:H); availability set to N as a pure XSS yields no real availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a network.
Executive ViewAI
DriveLock Operations Center web console versions 25.1.2 through 25.1.4 are affected by a critical cross-site scripting vulnerability (CVE-2025-67787, CVSS 9.6) that can let an unauthenticated attacker hijack an authenticated operator or administrator session. Because the console is used for security operations, a successful compromise could expose sensitive data and permit unauthorized changes, while no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis mean the risk is concentrated in exposed deployments where administrators can be lured to malicious content. Leadership should treat this as a high-priority exposure requiring immediate access restrictions, monitoring, and vendor follow-up.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the DriveLock Operations Center console, enforcing MFA and least privilege, deploying WAF XSS filtering, monitoring and revoking suspicious privileged sessions, and educating operators to avoid untrusted content.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
Local privilege escalation in the DriveLock Windows endpoint agent (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 bef
DriveLock tenants whose agent-authentication configuration is incomplete can be attacked by unauthenticated remote actor
Privilege escalation in DriveLock allows an authenticated user who holds the 'Manage roles and permissions' privilege to
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protect
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets re
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arb
Local privilege escalation in DriveLock endpoint-security agents (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 befor
Unprivileged local users on Windows hosts running affected DriveLock builds (24.1 before 24.1.6, 24.2 before 24.2.7, and
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authen
Incorrect permission assignments on directories and files created by the DriveLock endpoint agent let any local non-admi
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read
Cross-tenant information disclosure in DriveLock 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5) al
GitHub PoC
Exploit-DB