CVE-2026-5490

HIGH

DriveLock SQL Injection Privilege Escalation Vulnerability

Title source: cna
STIX 2.1

Description

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. . Was ZDI-CAN-28726.

References (2)

Core 2
Core References
X_Research Advisory x_research-advisory
ZDI-26-286
https://www.zerodayinitiative.com/advisories/ZDI-26-286/
Vendor Advisory vendor-advisory
vendor-provided URL
https://drivelock.help/sb/Content/SecurityBulletins/26-002-SQLInjection.htm

Scores

CVSS v3 8.8
EPSS 0.0048
EPSS Percentile 38.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
DriveLock/DriveLock 25.2.2.61370
Published Jul 29, 2026
Tracked Since Jul 30, 2026