DriveLock CVE-2025-67792

Requires the attacker to already hold an interactive local unprivileged account on a Windows machine running an affected DriveLock agent version (24.1 prior to 24.1.6, 24.2 prior to 24.2.7, or 25.1 prior to 25.1.5), and that agent process must be present and running for the privilege-escalation manipulation to succeed. Limiting factors that reduce real-world risk: there is no remote or network vector (AV:L) and no path to initial access from this flaw alone - the attacker must first obtain local code/command execution as a standard user; single-user, tightly controlled, or already-patched endpoints are not exposed. Exploitation is therefore constrained to environments where untrusted or semi-trusted users share Windows hosts protected by vulnerable DriveLock builds.

This is a credible local privilege escalation issue that should be prioritized on hosts running DriveLock endpoint-security software, though it is not an internet-facing emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) is internally consistent with the description: a local, already-authenticated low-privileged user manipulates a DriveLock process to run arbitrary commands, yielding full confidentiality, integrity, and availability impact - the classic high-severity local EoP profile. No EPSS score, no CISA KEV listing, and no POC indicator were supplied, so exploitation status is 'no public exploit identified at time of analysis'; the absence of these signals means there is no evidence of widespread or active exploitation and this should not be treated as a drive-by/remote threat. There is no SSVC decision data in the input. The main signals (local-only attack vector, requirement for pre-existing low-privilege access, and lack of any exploitation evidence) all point the same direction - a genuine but not panic-grade issue whose urgency is highest on multi-user or shared Windows endpoints where untrusted local users exist. No conflicting signals were found; the CVSS vector and the description agree that access is local and authenticated.

An attacker who already has an unprivileged account on a Windows endpoint protected by a vulnerable DriveLock version abuses the way a DriveLock process handles input or operations, coercing it into executing attacker-supplied commands in a higher-privileged context. This converts low-privileged foothold into effective administrative command execution on the host. No public exploit code was identified in the provided data.