What is the CVSS score of EUVD-2026-50496?

EUVD-2026-50496 has a CVSS 3.0 base score of 6.5 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 1.6%.

DriveLock EUVD-2026-50496

| CVE-2026-5492 MEDIUM

Path Traversal (CWE-22)

2026-07-29 zdi

GHSA-3mgm-5g78-fwgq

Information Disclosure Path Traversal Drivelock

6.5

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable web service requiring only low-privilege auth; path traversal yields file disclosure only, with no integrity or availability impact confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 20:00 vuln.today

DescriptionCVE.org

DriveLock Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of DriveLock. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28713.

AnalysisAI

Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authenticated remote user. The flaw, discovered by ZDI (ZDI-CAN-28713) and disclosed as ZDI-26-288, exists because the web service on TCP port 4568 accepts user-supplied path strings and passes them directly to file operations without sanitization, allowing directory traversal sequences to escape the intended working directory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor security bulletin has been published.

Technical ContextAI

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), a root-cause class where insufficient canonicalization or validation of user input allows an attacker to supply sequences such as '../' to navigate outside the intended directory tree before a file operation is executed. The affected component is DriveLock's proprietary web service, which listens on TCP port 4568 by default. The CPE string cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:* covers all versions of the DriveLock application without restriction, indicating the traversal flaw is present across the full product line rather than a specific release branch. DriveLock is an endpoint security and device control platform common in regulated enterprise environments, meaning its service account may hold access to sensitive policy files, cryptographic material, or endpoint data.

RemediationAI

Apply the vendor-issued patch documented in the DriveLock security bulletin 26-003 at https://www.drivelock.help/sb/Content/SecurityBulletins/26-003-PathValidation.htm - the exact patched version is not stated in available input data and must be confirmed against that advisory. Until patching is possible, restrict network access to TCP port 4568 via host-based firewall rules or network ACLs so that only explicitly authorized management systems can reach the DriveLock web service; this compensating control does not eliminate the flaw but substantially reduces exposure by requiring an attacker to already be on an authorized network segment. Additionally, audit which accounts hold DriveLock web service credentials and apply the principle of least privilege - revoking access for accounts that do not require it limits the pool of principals who can exploit the authenticated flaw. Note that restricting port 4568 may impact legitimate DriveLock management workflows; test in a staging environment before broad deployment.