DriveLock CVE-2025-67793

Requires an authenticated DOC (DriveLock Operations Center) user account that holds the 'Manage roles and permissions' privilege, which is included by default in the Administrator role; the attacker then makes a role-management API call to assign the Supervisor role. Exploitation is limited to DriveLock 24.1.x, 24.2.x, and 25.1 before 25.1.6, and the impact is meaningful primarily in cloud multi-tenant deployments - on-prem single-tenant installations are typically not affected because local admins already possess Supervisor-equivalent privileges, so no boundary is crossed. The key limiting factor is that the attacker must already control a high-privilege (Administrator-level) account.

The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) directly contradicts the description, which states the attacker must already hold the 'Manage roles and permissions' privilege - this is a privilege-escalation flaw, NOT a remote unauthenticated compromise, so the PR:N metric appears incorrect and should likely be PR:H (the privilege ships by default only in the Administrator role). Verify PR with the vendor; treated honestly this is an authenticated privilege-escalation issue where an already-privileged Administrator (or an attacker who has compromised such an account) can elevate to the all-powerful Supervisor role. EPSS score is not provided, the CVE is not in CISA KEV, and no public exploit code is referenced, so there is no evidence of active or opportunistic exploitation. Net real-world priority is moderate rather than critical: the headline 9.8 overstates risk because exploitation presupposes a high-privilege account, and the vendor explicitly scopes meaningful impact to cloud multi-tenant deployments (on-prem single-tenant admins already have Supervisor-equivalent access, making the escalation largely moot there). The principal threat model is a malicious or compromised tenant administrator crossing an intended authorization boundary.

A DriveLock Operations Center (DOC) user who holds the default Administrator role in a multi-tenant cloud deployment issues a crafted role-management API call that assigns the Supervisor role to their own or another account, bypassing the intended ceiling on their privileges. Because exploitation is a single straightforward API request (AC:L) over the network, a malicious insider or an attacker who has phished/compromised an Administrator account gains complete control. No public proof-of-concept is referenced at time of analysis.