EUVD-2026-50492
GHSA-4m2w-557x-2rqf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable arbitrary file read on default port 4568 gives AV:N/AC:L/PR:N/UI:N with C:H and no integrity or availability impact.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
2DescriptionCVE.org
DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28746.
AnalysisAI
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arbitrary files via directory traversal, exposing sensitive data in the context of the service account. The flaw stems from missing validation of a user-supplied path before it is used in file operations (CWE-22). Discovered and reported through the Zero Day Initiative (ZDI-26-284 / ZDI-CAN-28746); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
DriveLock is an enterprise endpoint-security / device-control and application-control suite whose management components expose an HTTP-based web service listening on TCP port 4568 by default. The vulnerability is a classic CWE-22 path traversal (relative/absolute path abuse) in which the service accepts a client-supplied path parameter and passes it into a file-read operation without canonicalizing or constraining it to an intended base directory. Because traversal sequences (e.g. ../) are not stripped or rejected, an attacker can escape the intended directory and read files anywhere the service account can access. Per the CPE (cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:*), the affected component is the DriveLock application itself rather than an OS or third-party library.
RemediationAI
Apply the fix described in DriveLock Security Bulletin 26-003 (https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm); patch available per vendor advisory, though an exact fixed version number is not stated in the provided data, so confirm the target build directly with the bulletin before upgrading. As a compensating control until patched, restrict network access to TCP port 4568 using host or network firewall rules so that only trusted management hosts can reach the web service - this closes the remote attack surface but may break legitimate management or agent communication that relies on that port, so validate connectivity after applying. Where feasible, place the DriveLock web service behind a reverse proxy or VPN and remove any direct exposure to untrusted or internet-facing networks. Also review service-account permissions to limit what files the account (and therefore a successful traversal) can read, and monitor the service logs for anomalous path parameters containing traversal sequences.
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protect
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets re
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authen
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read
In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privilege
Same weakness CWE-22 – Path Traversal
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today