DriveLock Agent
CVE-2025-67794
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated local user on agent host
-
ExploitAbuse overly permissive ACLs on agent files/directories
-
ExecutionModify or replace agent-created objects
-
ImpactTrigger unauthorized actions or destabilize/crash agent
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Requires an interactive local account (non-administrator) on a host running an affected DriveLock agent (24.1-24.1.*, 24.2 before 24.2.8, or 25.1 before 25.1.6); no vendor-documented special feature or non-default configuration is named, so default installations appear affected. Exploitation is limited by the need for local access and an authenticated low-privileged session (PR:L) - it is not remotely reachable, and impact is bounded to integrity and partial availability of the agent rather than confidentiality or full system compromise. |
| Impact | This is a moderate-risk local privilege/integrity issue, not an urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 6.1) describes a locally-exploitable flaw requiring an authenticated low-privileged user, with high integrity impact and low availability impact but no confidentiality impact - consistent with CWE-732 (overly permissive ACLs on agent-created files/directories). All exploitation signals point low: EPSS is 0.12% (1st percentile), there is no CISA KEV listing, and no public POC was provided, so this is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The signals are internally consistent - a low real-world exploitation probability aligned with a local-only attack vector - so this is a legitimate hardening/patch item for DriveLock-managed endpoints rather than an emergency. Note one metadata conflict: the input Tags include 'Information Disclosure,' yet the CVSS vector explicitly sets C:N (no confidentiality impact) and the description describes triggering actions and destabilizing the agent (integrity/availability), so the information-disclosure characterization is not supported by the provided data. |
| Exploit ScenarioDerived | A local, non-administrator user on a workstation running the DriveLock agent discovers that files and directories the agent creates carry overly permissive ACLs. The attacker modifies or replaces those agent-owned objects to trigger unintended agent actions or to crash/destabilize the agent, undermining the endpoint-security controls it enforces. No public exploit code was identified, and exploitation requires existing local access to the affected host. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Incorrect permission assignments on directories and files created by the DriveLock endpoint agent let any local non-administrator account tamper with agent-owned resources, which can trigger unexpected agent actions or destabilize the agent on the host. Affected builds are DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6, and exploitation requires an interactive low-privileged local session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 6.1), so it is a moderate local integrity/availability issue rather than a remote or system-wide compromise. No public exploit code has been identified at time of analysis and the EPSS score is 0.12% (1st percentile), indicating low predicted exploitation activity; vendor-released patches are available in 24.2.8 and 25.1.6.
RemediationAI
Upgrade the DriveLock agent to 24.2.8 or 25.1.6 (or a later build in the applicable branch) as documented in vendor security bulletin 25-009 at https://drivelock.help/sb/Content/SecurityBulletins/25-009-AgIncPermissions.htm; these are the vendor-released fixed versions and should be deployed through the normal DriveLock management console so that endpoint agents are refreshed centrally. Until patching completes, compensating controls are needed because this is a local, low-privilege tampering issue with no network vector: restrict interactive logon on servers and kiosks to accounts that genuinely require it, since the flaw depends on a non-administrator local session being present; monitor and, where feasible, use host hardening baselines or ACL auditing tools to detect modification of DriveLock agent directories and files (note that the very ACLs at issue may need to be corrected by the agent update, so manual ACL tightening could be overwritten on agent upgrade or restart); and watch DriveLock agent service health, unexpected agent stops, and agent-driven action anomalies as early indicators that the permissions have been abused. Removing administrative rights from general users and applying least-privilege endpoint policies reduces the attack surface and carries no functional side effects for standard users, whereas disabling or uninstalling the agent would eliminate the vulnerable component but leave the endpoint without its security and policy enforcement. No vendor-released patch alternative or exploit code is currently documented beyond the fixed builds.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource). The DriveLock agent - an endpoint security and device/application control client that runs with high privileges on managed Windows endpoints - creates working directories, configuration files, log files, or temporary artifacts with ACLs that grant write or modify rights to non-administrative local users. Because the agent later reads, executes, or trusts content from those locations, a low-privileged user can modify, replace, or plant data there, influencing agent behavior. The vulnerability class exploits the trust boundary between the privileged agent process and the lower-privileged filesystem namespace it shares with ordinary users; typical outcomes are agent malfunction, denial of protection, or manipulation of agent-driven actions. The CVSS vector confirms the attack is local (AV:L), requires only low privileges (PR:L: an authenticated non-admin interactive session), needs no user interaction (UI:N), and is scoped to the agent (S:U), with high integrity impact (I:H), partial availability impact (A:L), and no confidentiality impact (C:N), consistent with tampering/destabilization rather than credential or data theft. CPE data identifies the affected product tree as drivelock:drivelock across the three affected version branches.
Know when Drivelock gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Overly permissive ACLs are abusable only by a local authenticated user (AV:L, PR:L, AC:L); integrity is highly impacted while confidentiality is unaffected (C:N) and availability only partially (A:L).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the agent are created with overly permissive ACLs, allowing local users without administrator rights to trigger actions or destabilize the agent.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Local privilege escalation in the DriveLock Windows endpoint agent (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 bef
DriveLock tenants whose agent-authentication configuration is incomplete can be attacked by unauthenticated remote actor
Privilege escalation in DriveLock allows an authenticated user who holds the 'Manage roles and permissions' privilege to
Cross-site scripting in the DriveLock Operations Center web console (versions 25.1.2 through 25.1.4) lets an attacker in
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protect
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets re
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arb
Local privilege escalation in DriveLock endpoint-security agents (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 befor
Unprivileged local users on Windows hosts running affected DriveLock builds (24.1 before 24.1.6, 24.2 before 24.2.7, and
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authen
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read
Cross-tenant information disclosure in DriveLock 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5) al
GitHub PoC
Exploit-DB