DriveLock CVE-2026-5492

Authentication is required - the CVSS vector PR:L confirms that a valid low-privilege credential for the DriveLock web service is the minimum prerequisite. The DriveLock web service must be reachable by the attacker on TCP port 4568 (the default listening port). No non-default configuration is implied; the flaw appears to exist in the core web service component present in all DriveLock installations. Exploitation is constrained to files readable by the DriveLock service account identity - files outside that account's access permissions cannot be disclosed. No user interaction is required on the target system, and attack complexity is low once credentials are obtained.

The CVSS 3.0 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the primary risk drivers: the attack is network-accessible with low complexity and requires only low-privilege authentication, while impact is limited exclusively to confidentiality with no integrity or availability component. The high confidentiality impact (C:H) is appropriate given that file disclosure occurs in the context of the service account, which in DriveLock deployments may have broad read access to policy stores or configuration data. No EPSS score was provided in the input, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No public proof-of-concept has been identified. The real-world priority is moderate: the authentication requirement (PR:L) meaningfully limits the attack surface compared to unauthenticated traversal flaws, but any valid DriveLock web service credential - including lower-privileged users - would be sufficient. Organizations with DriveLock exposed internally to a broad user base face higher residual risk than those with strict network segmentation around port 4568.

An authenticated user with a low-privilege DriveLock web service account sends a crafted HTTP request to port 4568 containing path traversal sequences (e.g., '../../etc/drivelock/keys') targeting files readable by the DriveLock service account. The web service, lacking input validation, resolves the traversed path and returns the file contents in the response, allowing the attacker to enumerate and exfiltrate sensitive configuration or credential data. No public exploit code has been identified, but the technique is well-understood and requires no specialized tooling beyond a standard HTTP client.