CVE-2025-67791
Published: 17 December 2025
Description
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES (DriveLock Enterprise Service).
Mitigating Controls (NIST 800-53 r5)AI
Directly requires authentication of devices such as DriveLock agents before establishing connections with the DES, preventing unauthorized impersonation due to incomplete agent authentication.
Mandates establishment and verification of secure configuration settings for agent authentication in the DriveLock tenant, directly addressing the incomplete configuration vulnerability.
Ensures proper management and distribution of authenticators used by DriveLock agents, mitigating risks from improperly configured or weak authentication mechanisms.
Security SummaryAI
CVE-2025-67791, published on 2025-12-17, is a critical vulnerability with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting DriveLock versions 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. The flaw involves an incomplete configuration in agent authentication within the DriveLock tenant, which allows attackers to impersonate any DriveLock agent on the network when interacting with the DES (DriveLock Enterprise Service). It is linked to CWE-287 (Improper Authentication).
The vulnerability can be exploited by unauthenticated remote attackers with network access to the affected DES, requiring low complexity and no user interaction. Exploitation enables full impersonation of legitimate agents, granting high-impact access that compromises confidentiality, integrity, and availability of the DriveLock Enterprise Service.
Mitigation details are provided in the vendor's security bulletin at https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-006-DESMisconfig.htm.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote exploitation of the DriveLock Enterprise Service (DES) via improper agent authentication (T1210) and allows full impersonation of legitimate DriveLock agents (T1656).