CVE-2025-67793

An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://drivelock.help/sb/Content/SecurityBulletins/25-008-DESPrivilegeEsc.htm	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:drivelock:drivelock::::::::
	cpe:2.3:a:drivelock:drivelock::::::::
	cpe:2.3:a:drivelock:drivelock::::::::

History

13 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en DriveLock 24.1 hasta 24.1., 24.2 hasta 24.2., y 25.1 anterior a 25.1.6. Los usuarios con el privilegio 'Administrar roles y permisos' pueden ascenderse a sí mismos o a otros usuarios de DOC al rol de Supervisor mediante una llamada a la API. Este privilegio está incluido por defecto en el rol de Administrador. Este problema afecta principalmente a las implementaciones multi-inquilino en la nube; las instalaciones locales mono-inquilino no suelen verse afectadas porque los administradores locales normalmente ya tienen privilegios de Supervisor.

Information

Published : 2025-12-17 21:16

Updated : 2026-10-13 11:10

NVD link : CVE-2025-67793

Mitre link : CVE-2025-67793

CVE.ORG link : CVE-2025-67793

JSON object : View

Products Affected

drivelock

drivelock

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2025-67793", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67793", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-18T19:51:52.002139Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-17T21:16:16.443", "references": [{"url": "https://drivelock.help/sb/Content/SecurityBulletins/25-008-DESPrivilegeEsc.htm", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the \"Manage roles and permissions\" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en DriveLock 24.1 hasta 24.1.*, 24.2 hasta 24.2.*, y 25.1 anterior a 25.1.6. Los usuarios con el privilegio 'Administrar roles y permisos' pueden ascenderse a s\u00ed mismos o a otros usuarios de DOC al rol de Supervisor mediante una llamada a la API. Este privilegio est\u00e1 incluido por defecto en el rol de Administrador. Este problema afecta principalmente a las implementaciones multi-inquilino en la nube; las instalaciones locales mono-inquilino no suelen verse afectadas porque los administradores locales normalmente ya tienen privilegios de Supervisor."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49C36C7E-4B1F-44C4-825A-CFFD6CB1BE1F", "versionEndIncluding": "24.1.6", "versionStartIncluding": "24.1"}, {"criteria": "cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BF5B803-3A0B-47C1-A931-6E8996919E61", "versionEndIncluding": "24.2.8", "versionStartIncluding": "24.2"}, {"criteria": "cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FD804DF-40A9-4A76-950E-06EBD968CFE9", "versionEndExcluding": "25.1.6", "versionStartIncluding": "25.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}