DriveLock
CVE-2025-67789
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to DriveLock API
-
ExploitQuery cross-tenant computer-count endpoint
-
ImpactRetrieve other tenants' device counts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session against the DriveLock API in a multi-tenant deployment, and the deployment must host multiple tenants for any cross-tenant data to exist (the leaked data is another tenant's computer count). Per the description, exploitation is limited to authenticated users, so an attacker needs legitimate or compromised API credentials; single-tenant installations have no cross-tenant data to expose. NOTE: the input CVSS vector's PR:N is inconsistent with the description's authenticated-user requirement - treat authentication as required pending vendor confirmation. |
| Impact | This is a low-to-moderate priority information disclosure flaw (CVSS 5.3), not a critical issue. Multiple low-risk signals align: EPSS is 0.22% (12th percentile) indicating very low predicted exploitation likelihood, there is no CISA KEV listing (no public exploit identified at time of analysis), and no POC is referenced. The exploitation status is 'no public exploit identified at time of analysis.' The technical impact is narrow - disclosure of the computer count belonging to other DriveLock tenants (C:L, I:N, A:N) - which is reconnaissance-grade metadata rather than sensitive data or code execution. IMPORTANT CONFLICT: the supplied CVSS 3.1 vector asserts PR:N (unauthenticated) while the description explicitly states 'Authenticated users can retrieve' - these disagree, so the no-auth claim in the vector should be treated as questionable and verified with the vendor; realistically this requires an authenticated API session. Overall, even accounting for the network attack vector and low complexity, the combination of required authentication (per description), trivial impact, and near-zero exploitation signals makes this a low-urgency patch-in-normal-cycle item rather than an emergency. |
| Exploit ScenarioDerived | An authenticated user of one DriveLock tenant issues a crafted request to the DriveLock API and, due to missing tenant-isolation checks (CWE-284), receives the computer count belonging to other tenants on the same multi-tenant deployment. No public exploit code is known; the network attack vector and low complexity mean the request itself is simple, but a valid API credential is required per the description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Cross-tenant information disclosure in DriveLock 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5) allows an authenticated API user to retrieve the computer count of other DriveLock tenants through the management API. The issue is rated CVSS 5.3 and only has an impact in multi-tenant deployments, where it exposes limited aggregate inventory metadata (a computer count) rather than configuration or endpoint data; single-tenant installations have no cross-tenant data to leak. No public exploit identified at time of analysis, and EPSS is low at 0.22% (12th percentile), so this is a low-to-moderate priority flaw rather than an emergency patch item.
RemediationAI
Vendor-released patches fix this issue: upgrade to DriveLock 24.1.6, 24.2.7, or 25.1.5 depending on your branch, as documented in the vendor security bulletin at https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-004-DESInfoDisclosure.htm. Until patching is complete, restrict network access to the DriveLock management API so that only trusted administrative subnets or VPN clients can reach it, and, where the deployment supports it, disable or gate API endpoints that expose tenant-level inventory aggregation; the trade-off is reduced administrative convenience and breakage of monitoring integrations that rely on those endpoints. Also review and rotate API credentials issued to tenants, since the flaw requires a valid authenticated session, and confirm tenant isolation settings are enforced at the server level for any multi-tenant instance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying weakness is CWE-284 (Improper Access Control): the DriveLock API does not enforce tenant scoping on the endpoint that reports computer counts, so a tenant-scoped identifier or request can be manipulated to return another tenant's aggregated inventory value. DriveLock is an endpoint security suite that provides device control, application control, and full-disk encryption managed through a central server, and that server can be operated in a multi-tenant configuration by service providers. CPE data confirms the affected package as drivelock:drivelock across the 24.1, 24.2, and 25.1 branches. Because only a numeric count is disclosed, the confidentiality impact is Low (C:L) with no integrity or availability effect; exploitation requires a valid authenticated session against the API and a deployment that actually hosts multiple tenants, which is why the authoritative assessment adopts PR:L rather than the PR:N shown in the supplied vector - authentication is required pending vendor confirmation.
Know when Drivelock gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description states authenticated users, so PR:L (not PR:N); network API with low complexity; only a tenant's computer count leaks, so C:L and I:N/A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of other DriveLock tenants via the DriveLock API.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Local privilege escalation in the DriveLock Windows endpoint agent (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 bef
DriveLock tenants whose agent-authentication configuration is incomplete can be attacked by unauthenticated remote actor
Privilege escalation in DriveLock allows an authenticated user who holds the 'Manage roles and permissions' privilege to
Cross-site scripting in the DriveLock Operations Center web console (versions 25.1.2 through 25.1.4) lets an attacker in
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protect
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets re
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arb
Local privilege escalation in DriveLock endpoint-security agents (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 befor
Unprivileged local users on Windows hosts running affected DriveLock builds (24.1 before 24.1.6, 24.2 before 24.2.7, and
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authen
Incorrect permission assignments on directories and files created by the DriveLock endpoint agent let any local non-admi
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read
GitHub PoC
Exploit-DB