EUVD-2026-50495
GHSA-gcjp-3vgm-hjcx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach DriveLock web service on TCP 6067
-
DeliverySend request with traversal path
-
ExploitBypass missing path validation
-
ExecutionRead arbitrary file as service account
-
ImpactExfiltrate sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the DriveLock web service on its default TCP port 6067 (or a customized port) and no authentication (PR:N), no user interaction, and no special product configuration - it works against default installations where the web service is enabled and reachable. The primary limiting factor is network exposure: an attacker must be able to reach port 6067 on the target host, so segmentation, host firewalls, or non-routing of the agent port materially reduce exploitability. Disclosure is bounded to files readable by the DriveLock service account (though that account is typically privileged), and there is no integrity or availability impact. |
| Impact | The CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes the worst-case reachability profile for an information-disclosure bug: network-reachable, low complexity, no privileges, and no user interaction, yielding 7.5 (High). The confidentiality-only impact (C:H, I:N, A:N) correctly caps this below critical - there is no code execution or tampering. No EPSS score was provided, so exploitation probability cannot be quantified; KEV status is not set (no confirmed active exploitation) and no POC is referenced, so the practical urgency rests on the fact that this is a trivially-triggered, pre-auth file read against a security agent. The main limiting factor is exposure: TCP 6067 is an endpoint-agent port that is often not internet-facing, so real-world risk is highest on flat internal networks or where the agent port is reachable across segments. Overall this is a genuine, easy-to-exploit disclosure primitive rather than an inflated high-CVSS finding, but its blast radius depends on network exposure of port 6067. |
| Exploit ScenarioDerived | An attacker with network reachability to an endpoint's TCP 6067 sends a crafted HTTP request whose path parameter contains directory-traversal sequences (e.g. ../../../../Windows/win.ini or a sensitive config/credential file), and the DriveLock web service returns the file contents under its privileged service account. Because no authentication or user interaction is required and attack complexity is low, exploitation is a single request; no public POC is currently referenced but the class is trivial to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets remote attackers read arbitrary files in the context of the service account by supplying a crafted path that is used unvalidated in file operations. Discovered and reported through Trend Micro's Zero Day Initiative (ZDI-26-287 / ZDI-CAN-28722), it carries a CVSS 3.0 base score of 7.5 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory - apply the DriveLock update referenced in security bulletin 26-003 (PathValidation) at https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm; the provided data does not include an exact fixed version number, so confirm the precise build with DriveLock before rollout and consult https://www.zerodayinitiative.com/advisories/ZDI-26-287/ for advisory context. As a compensating control until patched, restrict inbound access to TCP 6067 with host and network firewall rules so that only authorized DriveLock management infrastructure can reach the endpoint web service - the trade-off is that overly broad blocking may interfere with legitimate agent-to-management communication, so scope the allowlist to known management hosts. Network-segment the endpoints so the agent port is not reachable across untrusted VLANs or from the internet, and monitor 6067 for anomalous path-traversal patterns (requests containing ../ or absolute paths).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DriveLock is a Windows endpoint-security / device-control and data-protection suite whose components expose a management web service listening on TCP 6067. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): the service accepts a user-supplied path and uses it in a file operation without canonicalizing or constraining it to an intended base directory, so sequences such as ../ resolve outside the web root. Because the read occurs under the service account - typically a highly privileged local/SYSTEM-level context on the endpoint - any file readable by that account can be disclosed. The single CPE cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:* indicates the affected product line without pinning specific fixed versions.
Know when Drivelock gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated single-request file read reachable over the network gives AV:N/AC:L/PR:N/UI:N; disclosure-only impact under the service account yields C:H with I:N/A:N and no scope change.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
DescriptionCVE.org
DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the web service, which listens on TCP port 6067 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28722.
Executive ViewAI
The DriveLock endpoint-security agent contains an unauthenticated directory traversal vulnerability (CVE-2026-5491, CVSS 7.5) that allows remote attackers to read arbitrary files without authentication, directly compromising the confidentiality of data protected by the security tool-no public exploit identified at time of analysis. This affects all DriveLock deployments reachable from untrusted networks and creates a critical protection gap. Organizations must implement immediate compensating controls pending patch release.
Disable TCP 6067 web service if operationally feasible; if required, restrict network access via firewall to trusted administrative sources only. Deploy WAF or host-based IDS rules to detect and block directory traversal attack patterns (../, ..\, and URL-encoded variants). Implement continuous monitoring and alerting for suspicious file access requests. Monitor vendor channels weekly for patch release; consider interim migration to alternative endpoint-security solutions if organizational risk tolerance cannot tolerate extended exposure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Local privilege escalation in the DriveLock Windows endpoint agent (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 bef
DriveLock tenants whose agent-authentication configuration is incomplete can be attacked by unauthenticated remote actor
Privilege escalation in DriveLock allows an authenticated user who holds the 'Manage roles and permissions' privilege to
Cross-site scripting in the DriveLock Operations Center web console (versions 25.1.2 through 25.1.4) lets an attacker in
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protect
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arb
Local privilege escalation in DriveLock endpoint-security agents (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 befor
Unprivileged local users on Windows hosts running affected DriveLock builds (24.1 before 24.1.6, 24.2 before 24.2.7, and
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authen
Incorrect permission assignments on directories and files created by the DriveLock endpoint agent let any local non-admi
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read
Cross-tenant information disclosure in DriveLock 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5) al
Exploit-DB