CVE-2025-67794CWE-732

CVE-2025-67794

Medium · published December 18, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
1.5
In the wild
Unconfirmed
What it is

An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the agent are created with overly permissive ACLs, allowing local users without administrator rights to trigger actions or destabilize the agent.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00116 · 1.5th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-12-18T03:16Z
Affected products (3)
ProductVersionsFixed in
drivelock/drivelock≥ 24.1, ≤ 24.1.4—
drivelock/drivelock≥ 24.2, < 24.2.824.2.8
drivelock/drivelock≥ 25.1, < 25.1.625.1.6
References (1)
https://drivelock.help/sb/Content/SecurityBulletins/25-009-AgIncPermissions.htm · [email protected]
EPSS history
Timeline
  • 17 DEC 00:00Z
    An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6
    cvelistv5