DriveLock
CVE-2025-67791
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain network access to DES
-
DeliveryIdentify unauthenticated agent channel
-
ExploitForge agent identity handshake
-
ExecutionImpersonate trusted DriveLock agent
-
ImpactExfiltrate policy or falsify agent state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a DriveLock tenant whose agent-authentication configuration is incomplete/misconfigured, plus network reachability to the DriveLock Enterprise Service (DES). It is NOT a default-configuration flaw in every deployment - the DES's inability to verify agent identity stems from the missing/incomplete agent-authentication setting, which is the gating precondition. Given AV:N/PR:N/UI:N, no authentication or user interaction is needed once that misconfiguration exists, but correctly configured tenants are not exposed, which materially limits real-world reach. |
| Impact | The raw signals conflict, so the 9.8 headline overstates real-world urgency. CVSS 3.1 reports AV:N/AC:L/PR:N/UI:N with full C:H/I:H/A:H, and CWE-287 (Improper Authentication) fits an agent-impersonation flaw. However, the description explicitly conditions the issue on 'an incomplete configuration (agent authentication)' in the DriveLock tenant - this is NOT a universal default-config break, so the PR:N/AC:L 'critical, trivially exploitable' picture only holds for tenants that failed to fully configure agent authentication. Supporting signals point to low near-term risk: EPSS is 0.37% (29th percentile), there is no CISA KEV listing (no public exploit identified at time of analysis), and no POC is referenced. No SSVC decision data was provided. Net: this is a genuinely serious authentication-integrity issue for affected/misconfigured DriveLock DES deployments and should be remediated by validating agent-authentication configuration, but the combination of a required non-default misconfiguration, low EPSS, and no observed exploitation places it below internet-facing default-exploitable criticals in triage priority. |
| Exploit ScenarioDerived | An attacker with access to the same network segment as the DriveLock Enterprise Service (DES) in a tenant that has not fully configured agent authentication crafts agent traffic that impersonates a legitimate DriveLock agent. Because the DES cannot properly verify agent identity, the attacker is trusted as a managed endpoint and can pull agent-scoped configuration/policy data or submit falsified agent state. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
DriveLock tenants whose agent-authentication configuration is incomplete can be attacked by unauthenticated remote actors who impersonate any DriveLock agent on the network and interact with the DriveLock Enterprise Service (DES) as if they were a legitimate endpoint, affecting DriveLock 24.1.*, 24.2.*, and 25.1.*. This is a preconditioned misconfiguration rather than a default-state defect - correctly hardened tenants are not exposed - so the 9.8 CVSS headline and the very low EPSS score of 0.37% (29th percentile) point in different directions, and the raw signals suggest the headline overstates real-world urgency. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
RemediationAI
The primary fix is configuration, not a code upgrade: enable and correctly complete the DriveLock tenant's agent-authentication setting as described in DriveLock Security Bulletin 25-006 (https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-006-DESMisconfig.htm), and verify from the DES console that every managed agent is being authenticated rather than accepted anonymously; the vendor advisory is the authoritative source for the exact setting and any accompanying release-note version requirements (no specific patched build number is confirmed in the available data, so treat the vendor bulletin as the definitive reference). Deployment trade-off: turning on mutual agent authentication typically requires provisioning certificates or keys to every agent, so stage the change to avoid cutting off agents that have not yet received credentials. Until authentication is enforced, compensate by restricting network reachability to the DES agent port(s) with firewall rules or network segmentation so only the known management VLAN/subnet of agents can reach the service - this blocks impersonation attempts from other network segments but also blocks legitimate agents that roam off that subnet (e.g., remote or VPN-based endpoints), so scope the rule carefully. Additionally, review DES logs for connections originating from unexpected hosts or duplicate agent identities, since such anomalies are the practical detection signal for an already-exploited misconfigured tenant, and rotate any secrets or policy material that an impostor agent may have retrieved. No vendor-released patch is confirmed as required by the data available; if the vendor bulletin identifies a fixed DriveLock build for 24.1.*, 24.2.*, or 25.1.*, upgrade to that build in addition to correcting the configuration.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DriveLock is an endpoint security suite (full-disk encryption, device control, and endpoint policy enforcement) in which managed agents register with and take policy from the DriveLock Enterprise Service (DES). The flaw is rooted in CWE-287 (Improper Authentication): when the tenant's agent-authentication setting is missing or incomplete, the DES cannot verify the identity of a connecting agent, so any host that speaks the agent protocol can present itself as a legitimate DriveLock agent. Because the weakness is a configuration gap rather than a coding flaw in a fixed code path, exploitation is contingent on the deployment state of the tenant - with a complete agent-authentication configuration in place, the same protocol exchange is rejected. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) agree that no privileges (PR:N) or user interaction (UI:N) are needed once the misconfiguration exists; they diverge on availability impact, with the assessment scoring A:N rather than A:H, so confidentiality and integrity of the managed estate are the primary concerns - an impostor agent can receive policies, trusted configuration, and potentially files or credentials intended for legitimate endpoints, and can pollute policy/telemetry data the DES uses for management decisions. CPE data identifies the affected platform as cpe:2.3:a:drivelock:drivelock across three version branches.
Know when Drivelock gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network agent impersonation needs no auth/UI when the misconfiguration is present (AV:N/AC:L/PR:N/UI:N); impersonation yields data access and forged agent state (C:H/I:H) but no clear service-destruction path (A:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES (DriveLock Enterprise Service).
Executive ViewAI
DriveLock's Enterprise Service (DES) is vulnerable in versions 24.1.*, 24.2.*, and 25.1.*, allowing remote actors to impersonate legitimate agents and interact with the service when agent-authentication configuration is incomplete. This misconfiguration-dependent flaw poses a critical risk to organizations that have not fully hardened their DriveLock environments, potentially enabling unauthorized access to endpoint management functions. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis; leadership should prioritize verifying configuration hardening and monitoring for anomalous DES activity.
Ensure DriveLock agent-authentication configuration is correctly hardened and complete; restrict network access to the DriveLock Enterprise Service (DES) to trusted agents only; monitor for anomalous agent impersonation or unauthorized DES interactions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
Local privilege escalation in the DriveLock Windows endpoint agent (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 bef
Privilege escalation in DriveLock allows an authenticated user who holds the 'Manage roles and permissions' privilege to
Cross-site scripting in the DriveLock Operations Center web console (versions 25.1.2 through 25.1.4) lets an attacker in
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protect
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets re
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arb
Local privilege escalation in DriveLock endpoint-security agents (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 befor
Unprivileged local users on Windows hosts running affected DriveLock builds (24.1 before 24.1.6, 24.2 before 24.2.7, and
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authen
Incorrect permission assignments on directories and files created by the DriveLock endpoint agent let any local non-admi
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read
Cross-tenant information disclosure in DriveLock 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5) al
GitHub PoC
Exploit-DB