CVE-2025-67791 is a critical (CVSS 9.8) authentication weakness in DriveLock 24.1, 24.2 and 25.1. If agent authentication is incompletely configured, attackers can impersonate agents against the DriveLock Enterprise Service. DriveLock says the remedy is a configuration change in its Operations Center.
What's affected
DriveLock 24.1 through 24.1., 24.2 through 24.2. and 25.1 through 25.1.*, per the record. The vendor security bulletin 25-006 covers the DriveLock Enterprise Service (DES) and lists the affected versions in a table that I could not read in full, so confirm the exact list on the bulletin.
The vendor bulletin frames the problem as a misconfiguration of agent authentication, not a code defect. It says the mitigation is to correct the agent authentication configuration, and lists the fixed in field as not applicable. The record gives 9.8, critical. I found no vendor score on the bulletin text I fetched.
The bulletin says that attackers can impersonate agents and upload files into arbitrary tenants through the trace file functionality.
How to check if you're exposed
The check is in the DriveLock Operations Center (DOC), not on the command line. Follow the vendor bulletin: review the configuration of agent authentication, called out as the DOC configuration installation checkboxes, for every tenant.
Also confirm which DriveLock release each tenant runs, and whether the DES is reachable from networks that are not meant to host agents. If it is reachable from broad internal ranges or from the internet, the weakness has a much larger audience.
Review trace file uploads on the DES for files you do not recognize, especially in tenants that should be quiet.
What to do now
- Read DriveLock security bulletin 25-006 in full and note the affected versions.
- Correct the agent authentication configuration in the DOC for every tenant, as the bulletin instructs.
- Limit network access to the DES to the hosts and ranges that run agents.
- Review trace file uploads and tenant data for unexpected content.
- Stay on the latest DriveLock release, as the vendor recommends regardless of this issue.
Why it matters
The weakness is CWE-287, improper authentication. If agents are not required to prove who they are, anything that can reach the service and speak the protocol can claim to be an agent. Because the service is multi tenant, the risk includes writing into tenants the attacker should never touch.
This is a useful reminder that some serious CVEs are about secure defaults and setup, not about patches. A vulnerability scanner will not find it by reading a version string, which is why configuration review belongs in your process. The record does not list this CVE as known exploited.
Quick check
Is there a patched version?
The vendor bulletin lists the fixed in field as not applicable and points to a configuration change instead.
Why does the version list matter if it is a configuration issue?
The record limits the CVE to specific releases, so confirm both the release and the configuration.
Sources
Last reviewed: 18 October 2026.
