An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1…
Priority MEDIUM 43CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-269.
Summary
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged processes to gain more privileges on Windows computers.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:* | 24.1 to before 24.1.6; 24.2 to before 24.2.7; 25.1 to before 25.1.5 | Vulnerable | DriveLock |
- cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:* Versions 24.1 to before 24.1.6; 24.2 to before 24.2.7; 25.1 to before 25.1.5 Vulnerable ·DriveLock
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-67781
- 2026-10-03 Alias added: GHSA-c4hj-m2c4-rxf5
References
More Drivelock vulnerabilities
- TI-2025-41457 An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1… CVSS 3.1CRITICAL 9.8
- TI-2025-41455 An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1… CVSS 3.1CRITICAL 9.8
- TI-2025-41454 An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1… CVSS 3.1CRITICAL 9.8
- TI-2025-34864 In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4… CVSS 3.1CRITICAL 9.9
- TI-2025-41452 An issue was discovered in 25.1.2 before 25.1.5. CVSS 3.1CRITICAL 9.6
- TI-2025-41456 An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1… CVSS 3.1HIGH 8.8
Sources
- CVE-2025-67781 · CVE Program
- CVE-2025-67781 · NVD
- FIRST EPSS
- GHSA-c4hj-m2c4-rxf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences