What is the CVSS score of CVE-2026-5489?

CVE-2026-5489 has a CVSS 3.0 base score of 5.3 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 1.3%.

DriveLock CVE-2026-5489

EUVD-2026-50493 MEDIUM

Path Traversal (CWE-22)

2026-07-29 zdi

GHSA-3f85-wh3q-chmr

Information Disclosure Path Traversal Drivelock

5.3

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible, unauthenticated, no user interaction required; read-only file disclosure with no integrity or availability impact and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 20:00 vuln.today

DescriptionCVE.org

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28719.

AnalysisAI

Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read arbitrary files in the context of the service account, bypassing all authentication controls. The root cause is unsanitized user-supplied path input passed directly into file operations (CWE-22), making exploitation mechanically trivial for any attacker with network reach to the affected port. No public exploit code or active exploitation has been identified at time of analysis; the ZDI-CAN-28719 disclosure was handled through the Zero Day Initiative responsible disclosure program.

Technical ContextAI

DriveLock is an endpoint security and device control platform. The affected component is an internal web service that listens by default on TCP port 4568. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the service accepts a user-controlled path parameter and passes it to file operations without stripping or blocking traversal sequences such as '../', allowing an attacker to escape the intended base directory and access files anywhere the service account can read. The CPE string cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:* uses a wildcard version field, indicating no bounded version range was specified in available NVD data - all versions are potentially in scope until a vendor-confirmed fixed version is identified. This vulnerability was tracked internally by ZDI as ZDI-CAN-28719 and published as ZDI-26-285.

RemediationAI

Apply the vendor-released patch documented in the DriveLock security bulletin 26-001-DESForwarding at https://www.drivelock.help/sb/Content/SecurityBulletins/26-001-DESForwarding.htm - the exact patched version must be confirmed from that advisory, as no version number was present in the available intelligence data. As an immediate compensating control, restrict inbound access to TCP port 4568 using host-based firewall rules or network perimeter controls so that only trusted management hosts or IP ranges can reach the service; this eliminates remote exploitation but may affect legitimate DriveLock administrative connectivity and should be tested against operational workflows. Additionally, review and minimize the privileges of the service account running the DriveLock web service so that file disclosure is limited to only the directories required for operation, reducing the value of any files an attacker could read prior to patching.