PT-2026-33192 · Drivelock · Drivelock

CVE-2026-5490 · Published 2026-04-15 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DriveLock (affected versions not specified)

Description An issue exists in the web service that listens on TCP port 4568 by default. The flaw is caused by insufficient validation of a user-supplied string used to construct SQL queries, which allows authenticated remote attackers to perform a SQL Injection. This can be leveraged to escalate privileges and gain access to resources normally protected from the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-5490

ZDI-26-286

Affected Products

Drivelock

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-5490 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-26-286 · Security Note
• https://drivelock.help/sb/Content/SecurityBulletins/26-002-SQLInjection.htm · Vendor Advisory
• https://t.me/CVEtracker/61640 · Telegram Post
• https://twitter.com/TheZDIBugs/status/2044537515558813877 · Twitter Post