DriveLock EUVD-2026-50492

Exploitation requires network reachability to the DriveLock web service on TCP port 4568 (its default listening port); no authentication, credentials, or user interaction are needed (PR:N/UI:N). The primary limiting factor is exposure of that port - installations where port 4568 is firewalled off from untrusted networks are not remotely reachable - and the read is bounded by the privileges of the service account, so only files that account can access are disclosable. No non-default configuration is required beyond the web service being enabled and reachable.

All available signals point to a genuine, easily exploitable disclosure issue rather than a high-CVSS-but-low-real-risk case. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction and high confidentiality impact but no integrity or availability effect - consistent with arbitrary file read. No EPSS score, KEV entry, SSVC decision, or POC was provided in the input, so real-world exploitation probability cannot be quantified from this data; the absence of a POC and KEV listing suggests it is not yet known to be exploited at scale. The main factor tempering priority is deployment footprint: DriveLock is a niche endpoint-security product, so exposure depends on how many installations expose port 4568 to untrusted networks. Priority should be HIGH for any organization running DriveLock with the web service reachable from untrusted segments, given trivial exploitability and sensitive-data exposure.

An attacker with network reach to the DriveLock host sends a crafted HTTP request to the web service on TCP port 4568 containing a path parameter with directory-traversal sequences (e.g. ../../). Because the path is not validated, the service reads and returns a file outside the intended directory - such as configuration files, credentials, or logs - all without authentication. No public exploit is identified at time of analysis, but the low complexity makes weaponization straightforward.