CVE-2025-67793

CRITICAL

DriveLock 24.1-24.1., 24.2-24.2., 25.1 < 25.1.6 - Privilege Escalation via Role Promotion API

Title source: llm

Description

An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges.

References (1)

Core 1

Core References

Vendor Advisory

https://drivelock.help/sb/Content/SecurityBulletins/25-008-DESPrivilegeEsc.htm

Scores

CVSS v3 9.8

EPSS 0.0027

EPSS Percentile 18.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-269

Status published

Products (1)

drivelock/drivelock 24.1 - 24.1.6

Published Dec 17, 2025

Tracked Since Feb 18, 2026