CVE-2025-67789
📋 TL;DR
This vulnerability allows authenticated users of DriveLock to retrieve the computer count of other tenants via the API, potentially exposing organizational information. It affects DriveLock versions 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5.
💻 Affected Systems
- DriveLock
📦 What is this software?
Drivelock by Drivelock
Drivelock by Drivelock
Drivelock by Drivelock
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map organizational structures, identify high-value targets, or gather intelligence for further attacks by correlating tenant computer counts with other information.
Likely Case
Information disclosure about tenant sizes and potentially organizational structures, though limited to computer counts.
If Mitigated
Minimal impact if proper access controls and network segmentation are in place, as the information is relatively low-sensitivity.
🎯 Exploit Status
Exploitation requires valid authentication credentials and API access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.1.6, 24.2.7, or 25.1.5
Vendor Advisory: https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-004-DESInfoDisclosure.htm
Restart Required: Yes
Instructions:
1. Download the appropriate patch version from the vendor. 2. Apply the patch following DriveLock update procedures. 3. Restart affected services/systems.
🔧 Temporary Workarounds
Restrict API Access
allLimit API access to only necessary users and implement strict access controls.
🧯 If You Can't Patch
- Implement strict access controls and monitoring for API usage.
- Segment network to limit exposure of DriveLock API endpoints.
🔍 How to Verify
Check if Vulnerable:
Check DriveLock version via administrative interface or version files.Check Version:
Check DriveLock admin console or version.txt in installation directory.Verify Fix Applied:
Verify version is 24.1.6, 24.2.7, or 25.1.5 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual API requests for tenant information
- Multiple failed authentication attempts followed by successful API access
Network Indicators:
- Unusual patterns of API requests to tenant endpoints
SIEM Query:
source="DriveLock" AND (event_type="api_request" AND endpoint="*tenant*" AND user!="admin")