CVE-2025-67793
Privilege Escalation in DriveLock API Allows Supervisor Role Assignment
Publication date: 2025-12-17
Last updated on: 2025-12-18
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| drivelock | drivelock_enterprise_service | 25.1 |
| drivelock | drivelock_enterprise_service | 24.2 |
| drivelock | drivelock_enterprise_service | 24.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability in DriveLock Enterprise Service allows users who have the 'Manage roles and permissions' privilege—usually part of the Administrator role—to escalate their own or other DOC users' roles to Supervisor via an API call. This is an Incorrect Access Control / Role Escalation issue affecting mainly cloud multi-tenant deployments, enabling unauthorized privilege escalation through network-based API calls. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized privilege escalation, allowing users to gain Supervisor-level access. This can compromise system availability and confidentiality to a limited extent, especially in cloud multi-tenant environments. It may allow attackers or unauthorized users to perform actions reserved for Supervisors, potentially disrupting operations or accessing sensitive information. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring API calls that attempt to change user roles, specifically calls that promote DOC users to the Supervisor role. Enabling audit logging for role changes is recommended to track such activities. While specific commands are not provided, reviewing audit logs for role escalation events and monitoring network traffic for suspicious API calls related to role management can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the DriveLock Enterprise Service update to version 25.1.6 Patch 4 or later, restricting DOC admin accounts to trusted personnel only, and enabling audit logging for role changes to monitor for unauthorized privilege escalations. Keeping DriveLock updated with the latest releases is also advised to maintain security. [1]