PT-2025-51924 · Unknown+1 · Drivelock Enterprise Service+1

Published 2025-12-17 · Updated 2025-12-21 · CVE-2025-67791

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DriveLock versions 24.1 through 24.1.* DriveLock versions 24.2 through 24.2.* DriveLock versions 25.1 through 25.1.*

Description An incomplete configuration related to agent authentication in DriveLock tenants can allow attackers to impersonate any DriveLock agent on the network against the DriveLock Enterprise Service (DES). This allows attackers to potentially gain unauthorized access and control within the network.

Recommendations Update DriveLock to a version beyond 25.1.*. Review and correct the DriveLock tenant configuration to ensure proper agent authentication.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-67791

Affected Products

Drivelock

Drivelock Enterprise Service

References · 5

• https://osv.dev/vulnerability/CVE-2025-67791 · Vendor Advisory
• https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-006-DESMisconfig.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67791 · Security Note
• https://twitter.com/CVEnew/status/2002835989501243899 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001480491120177333 · Twitter Post