Drivelock
Monthly
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets remote attackers read arbitrary files in the context of the service account by supplying a crafted path that is used unvalidated in file operations. Discovered and reported through Trend Micro's Zero Day Initiative (ZDI-26-287 / ZDI-CAN-28722), it carries a CVSS 3.0 base score of 7.5 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protected from their account. The flaw lives in the DriveLock web service listening on TCP port 4568 by default, where a user-supplied string is concatenated into a SQL query without proper validation (CWE-89), and it carries a CVSS 8.8. There is no public exploit identified at time of analysis and it is not on CISA KEV, though it was discovered and coordinated through the Zero Day Initiative (ZDI-CAN-28726 / ZDI-26-286).
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arbitrary files via directory traversal, exposing sensitive data in the context of the service account. The flaw stems from missing validation of a user-supplied path before it is used in file operations (CWE-22). Discovered and reported through the Zero Day Initiative (ZDI-26-284 / ZDI-CAN-28746); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authenticated remote user. The flaw, discovered by ZDI (ZDI-CAN-28713) and disclosed as ZDI-26-288, exists because the web service on TCP port 4568 accepts user-supplied path strings and passes them directly to file operations without sanitization, allowing directory traversal sequences to escape the intended working directory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor security bulletin has been published.
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read arbitrary files in the context of the service account, bypassing all authentication controls. The root cause is unsanitized user-supplied path input passed directly into file operations (CWE-22), making exploitation mechanically trivial for any attacker with network reach to the affected port. No public exploit code or active exploitation has been identified at time of analysis; the ZDI-CAN-28719 disclosure was handled through the Zero Day Initiative responsible disclosure program.
Incorrect permission assignments on directories and files created by the DriveLock endpoint agent let any local non-administrator account tamper with agent-owned resources, which can trigger unexpected agent actions or destabilize the agent on the host. Affected builds are DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6, and exploitation requires an interactive low-privileged local session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 6.1), so it is a moderate local integrity/availability issue rather than a remote or system-wide compromise. No public exploit code has been identified at time of analysis and the EPSS score is 0.12% (1st percentile), indicating low predicted exploitation activity; vendor-released patches are available in 24.2.8 and 25.1.6.
DriveLock tenants whose agent-authentication configuration is incomplete can be attacked by unauthenticated remote actors who impersonate any DriveLock agent on the network and interact with the DriveLock Enterprise Service (DES) as if they were a legitimate endpoint, affecting DriveLock 24.1.*, 24.2.*, and 25.1.*. This is a preconditioned misconfiguration rather than a default-state defect - correctly hardened tenants are not exposed - so the 9.8 CVSS headline and the very low EPSS score of 0.37% (29th percentile) point in different directions, and the raw signals suggest the headline overstates real-world urgency. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Privilege escalation in DriveLock allows an authenticated user who holds the 'Manage roles and permissions' privilege to promote themselves or other DOC (DriveLock Operations Center) users to the Supervisor role via an API call, a privilege that is granted by default to the Administrator role. The flaw affects DriveLock 24.1 (24.1.*), 24.2 (24.2.*), and 25.1 before 25.1.6, and is most impactful in cloud multi-tenant deployments where it breaks the tenant/role boundary; on-prem single-tenant installations are typically unaffected because local administrators already hold Supervisor-equivalent rights. The vendor rates the issue at CVSS 9.8, but that vector uses PR:N, which contradicts the documented precondition that the attacker must already hold a privileged role - an independent assessment re-scores it as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (authenticated, high-privilege actor). No public exploit code was identified at the time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in DriveLock endpoint-security agents (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5) allows a standard, unprivileged Windows user to manipulate a DriveLock process and execute arbitrary commands with higher privileges, rated CVSS 7.8 (AV:L/PR:L/UI:N, high confidentiality, integrity, and availability impact). The flaw requires an attacker to already hold an interactive local account on an affected host, so it is a post-access escalation primitive rather than an initial-access vector; it is not remotely exploitable and there is no public exploit identified at time of analysis. Risk is concentrated on multi-user or semi-trusted Windows endpoints running vulnerable DriveLock builds, where any local user can leverage the agent's own process to gain system-level control.
Unprivileged local users on Windows hosts running affected DriveLock builds (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5) can intermittently crash the machine with a Blue Screen of Death by sending a device IOCTL containing an unterminated string to the DriveLock kernel driver, triggering a buffer over-read. The flaw is an improper null-termination (CWE-170) defect that is availability-only: there is no code execution, no privilege escalation, and no confirmed data disclosure, and it requires a valid local interactive session (no remote path), which is why the practical risk is lower than the 7.5 HIGH score implies. No public exploit code or active exploitation has been identified at time of analysis, and vendor patches are available for all three affected branches.
Cross-tenant information disclosure in DriveLock 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5) allows an authenticated API user to retrieve the computer count of other DriveLock tenants through the management API. The issue is rated CVSS 5.3 and only has an impact in multi-tenant deployments, where it exposes limited aggregate inventory metadata (a computer count) rather than configuration or endpoint data; single-tenant installations have no cross-tenant data to leak. No public exploit identified at time of analysis, and EPSS is low at 0.22% (12th percentile), so this is a low-to-moderate priority flaw rather than an emergency patch item.
Cross-site scripting in the DriveLock Operations Center web console (versions 25.1.2 through 25.1.4) lets an attacker inject script that executes in the browser of an authenticated operator or administrator, enabling session takeover and full compromise of the hijacked console session. The attacker needs no credentials of their own (CVSS PR:N), but exploitation requires the victim to view or interact with attacker-controlled content (UI:R), and the scope change (S:C) plus high confidentiality and integrity impact are why the base score reaches 9.6 despite that interaction requirement. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV); EPSS is low at 0.26% (16th percentile), so the practical risk is concentrated in exposed DriveLock Operations Center deployments whose administrators can be lured into loading crafted content.
Local privilege escalation in the DriveLock Windows endpoint agent (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5) allows an authenticated but unprivileged local user to manipulate the product's privileged processes and obtain elevated rights, up to full administrative control of the host. The published CVSS 9.9 reflects a network-vector, scope-changed interpretation, whereas independent assessment scores the flaw as a local, scope-unchanged escalation (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming exploitation requires an existing interactive session on the Windows endpoint and is neither remote nor unauthenticated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was provided, but a full local-to-SYSTEM/administrator escalation in an endpoint-security agent is a high-value post-compromise target across managed fleets.
In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated directory traversal in the DriveLock endpoint-security agent's web service (TCP 6067 by default) lets remote attackers read arbitrary files in the context of the service account by supplying a crafted path that is used unvalidated in file operations. Discovered and reported through Trend Micro's Zero Day Initiative (ZDI-26-287 / ZDI-CAN-28722), it carries a CVSS 3.0 base score of 7.5 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protected from their account. The flaw lives in the DriveLock web service listening on TCP port 4568 by default, where a user-supplied string is concatenated into a SQL query without proper validation (CWE-89), and it carries a CVSS 8.8. There is no public exploit identified at time of analysis and it is not on CISA KEV, though it was discovered and coordinated through the Zero Day Initiative (ZDI-CAN-28726 / ZDI-26-286).
Unauthenticated information disclosure in DriveLock's web service (default TCP port 4568) lets remote attackers read arbitrary files via directory traversal, exposing sensitive data in the context of the service account. The flaw stems from missing validation of a user-supplied path before it is used in file operations (CWE-22). Discovered and reported through the Zero Day Initiative (ZDI-26-284 / ZDI-CAN-28746); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authenticated remote user. The flaw, discovered by ZDI (ZDI-CAN-28713) and disclosed as ZDI-26-288, exists because the web service on TCP port 4568 accepts user-supplied path strings and passes them directly to file operations without sanitization, allowing directory traversal sequences to escape the intended working directory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor security bulletin has been published.
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read arbitrary files in the context of the service account, bypassing all authentication controls. The root cause is unsanitized user-supplied path input passed directly into file operations (CWE-22), making exploitation mechanically trivial for any attacker with network reach to the affected port. No public exploit code or active exploitation has been identified at time of analysis; the ZDI-CAN-28719 disclosure was handled through the Zero Day Initiative responsible disclosure program.
Incorrect permission assignments on directories and files created by the DriveLock endpoint agent let any local non-administrator account tamper with agent-owned resources, which can trigger unexpected agent actions or destabilize the agent on the host. Affected builds are DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6, and exploitation requires an interactive low-privileged local session (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, base 6.1), so it is a moderate local integrity/availability issue rather than a remote or system-wide compromise. No public exploit code has been identified at time of analysis and the EPSS score is 0.12% (1st percentile), indicating low predicted exploitation activity; vendor-released patches are available in 24.2.8 and 25.1.6.
DriveLock tenants whose agent-authentication configuration is incomplete can be attacked by unauthenticated remote actors who impersonate any DriveLock agent on the network and interact with the DriveLock Enterprise Service (DES) as if they were a legitimate endpoint, affecting DriveLock 24.1.*, 24.2.*, and 25.1.*. This is a preconditioned misconfiguration rather than a default-state defect - correctly hardened tenants are not exposed - so the 9.8 CVSS headline and the very low EPSS score of 0.37% (29th percentile) point in different directions, and the raw signals suggest the headline overstates real-world urgency. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Privilege escalation in DriveLock allows an authenticated user who holds the 'Manage roles and permissions' privilege to promote themselves or other DOC (DriveLock Operations Center) users to the Supervisor role via an API call, a privilege that is granted by default to the Administrator role. The flaw affects DriveLock 24.1 (24.1.*), 24.2 (24.2.*), and 25.1 before 25.1.6, and is most impactful in cloud multi-tenant deployments where it breaks the tenant/role boundary; on-prem single-tenant installations are typically unaffected because local administrators already hold Supervisor-equivalent rights. The vendor rates the issue at CVSS 9.8, but that vector uses PR:N, which contradicts the documented precondition that the attacker must already hold a privileged role - an independent assessment re-scores it as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (authenticated, high-privilege actor). No public exploit code was identified at the time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in DriveLock endpoint-security agents (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5) allows a standard, unprivileged Windows user to manipulate a DriveLock process and execute arbitrary commands with higher privileges, rated CVSS 7.8 (AV:L/PR:L/UI:N, high confidentiality, integrity, and availability impact). The flaw requires an attacker to already hold an interactive local account on an affected host, so it is a post-access escalation primitive rather than an initial-access vector; it is not remotely exploitable and there is no public exploit identified at time of analysis. Risk is concentrated on multi-user or semi-trusted Windows endpoints running vulnerable DriveLock builds, where any local user can leverage the agent's own process to gain system-level control.
Unprivileged local users on Windows hosts running affected DriveLock builds (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5) can intermittently crash the machine with a Blue Screen of Death by sending a device IOCTL containing an unterminated string to the DriveLock kernel driver, triggering a buffer over-read. The flaw is an improper null-termination (CWE-170) defect that is availability-only: there is no code execution, no privilege escalation, and no confirmed data disclosure, and it requires a valid local interactive session (no remote path), which is why the practical risk is lower than the 7.5 HIGH score implies. No public exploit code or active exploitation has been identified at time of analysis, and vendor patches are available for all three affected branches.
Cross-tenant information disclosure in DriveLock 24.1 (before 24.1.6), 24.2 (before 24.2.7), and 25.1 (before 25.1.5) allows an authenticated API user to retrieve the computer count of other DriveLock tenants through the management API. The issue is rated CVSS 5.3 and only has an impact in multi-tenant deployments, where it exposes limited aggregate inventory metadata (a computer count) rather than configuration or endpoint data; single-tenant installations have no cross-tenant data to leak. No public exploit identified at time of analysis, and EPSS is low at 0.22% (12th percentile), so this is a low-to-moderate priority flaw rather than an emergency patch item.
Cross-site scripting in the DriveLock Operations Center web console (versions 25.1.2 through 25.1.4) lets an attacker inject script that executes in the browser of an authenticated operator or administrator, enabling session takeover and full compromise of the hijacked console session. The attacker needs no credentials of their own (CVSS PR:N), but exploitation requires the victim to view or interact with attacker-controlled content (UI:R), and the scope change (S:C) plus high confidentiality and integrity impact are why the base score reaches 9.6 despite that interaction requirement. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV); EPSS is low at 0.26% (16th percentile), so the practical risk is concentrated in exposed DriveLock Operations Center deployments whose administrators can be lured into loading crafted content.
Local privilege escalation in the DriveLock Windows endpoint agent (24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5) allows an authenticated but unprivileged local user to manipulate the product's privileged processes and obtain elevated rights, up to full administrative control of the host. The published CVSS 9.9 reflects a network-vector, scope-changed interpretation, whereas independent assessment scores the flaw as a local, scope-unchanged escalation (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), confirming exploitation requires an existing interactive session on the Windows endpoint and is neither remote nor unauthenticated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was provided, but a full local-to-SYSTEM/administrator escalation in an endpoint-security agent is a high-value post-compromise target across managed fleets.
In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.