DriveLock CVE-2026-5489

The DriveLock web service must be running and TCP port 4568 must be reachable from the attacker's network location - the CVSS vector PR:N/AV:N/AC:L/UI:N confirms no authentication, no elevated complexity, and no user interaction are required against a default DriveLock installation. Exploitation is limited by: (1) network segmentation - if port 4568 is firewalled to internal management networks only, remote exploitation from untrusted segments is blocked; (2) service account privilege scope - file disclosure is bounded by what the DriveLock service account can read on the host, not necessarily SYSTEM-level access; (3) impact is strictly read-only (I:N, A:N) - no write, delete, or denial-of-service capability is exposed through this vector.

The CVSS 3.0 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N is well-aligned with the description: the attack is network-accessible, requires no authentication, no user interaction, and no special configuration, but impact is limited to partial confidentiality loss (read-only, service account scope). No EPSS data was supplied in the intelligence inputs, so exploitation probability cannot be quantified here. This CVE is not listed in the CISA KEV catalog, and no POC code has been identified, both of which suggest no confirmed widespread exploitation. Despite the moderate CVSS, the combination of zero prerequisites and network accessibility makes this operationally simple to exploit - the primary risk driver is network exposure of port 4568 to untrusted segments. In environments where port 4568 is firewalled to management networks only, real-world risk is substantially reduced. The read-only nature of the impact (I:N, A:N) limits blast radius but sensitive files readable by the service account - such as credentials, configuration data, or internal certificates - could enable privilege escalation as a follow-on step.

An unauthenticated attacker with network access to TCP port 4568 sends an HTTP request to the DriveLock web service with a crafted path parameter containing traversal sequences (e.g., ../../Windows/System32/config/SAM or ../../etc/drivelock.conf). The service processes the unsanitized path and returns the contents of the targeted file in the HTTP response, disclosing it in the context of the DriveLock service account. No public POC has been identified, but given AC:L and PR:N, manual exploitation requires only a basic HTTP client.