An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1…
Priority LOW 37CWE-732Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the agent are created with overly permissive ACLs, allowing local users without administrator rights to trigger actions or destabilize the agent.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00116 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:* | 24.1 – 24.1.4; 24.2 to before 24.2.8; 25.1 to before 25.1.6 | Vulnerable | DriveLock |
- cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:* Versions 24.1 – 24.1.4; 24.2 to before 24.2.8; 25.1 to before 25.1.6 Vulnerable ·DriveLock
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-67794
- 2026-10-03 Alias added: GHSA-2jw8-98p7-866p
References
More Drivelock vulnerabilities
- TI-2025-41457 An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1… CVSS 3.1CRITICAL 9.8
- TI-2025-41455 An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1… CVSS 3.1CRITICAL 9.8
- TI-2025-41454 An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1… CVSS 3.1CRITICAL 9.8
- TI-2025-41451 An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1… CVSS 3.1CRITICAL 9.9
- TI-2025-34864 In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4… CVSS 3.1CRITICAL 9.9
- TI-2025-41452 An issue was discovered in 25.1.2 before 25.1.5. CVSS 3.1CRITICAL 9.6
Sources
- CVE-2025-67794 · CVE Program
- CVE-2025-67794 · NVD
- FIRST EPSS
- GHSA-2jw8-98p7-866p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences