CVE-2025-67791
Published: 17 December 2025
Summary
CVE-2025-67791 is a critical-severity Improper Authentication (CWE-287) vulnerability in Drivelock Drivelock. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and IA-3 (Device Identification and Authentication).
Deeper analysis
CVE-2025-67791, published on 2025-12-17, is a critical vulnerability with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) affecting DriveLock versions 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. The flaw involves an incomplete configuration in agent authentication within the DriveLock tenant, which allows attackers to impersonate any DriveLock agent on the network when interacting with the DES (DriveLock Enterprise Service). It is linked to CWE-287 (Improper Authentication).
The vulnerability can be exploited by unauthenticated remote attackers with network access to the affected DES, requiring low complexity and no user interaction. Exploitation enables full impersonation of legitimate agents, granting high-impact access that compromises confidentiality, integrity, and availability of the DriveLock Enterprise Service.
Mitigation details are provided in the vendor's security bulletin at https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-006-DESMisconfig.htm.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-203992
Vulnerability details
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES (DriveLock Enterprise Service).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote exploitation of the DriveLock Enterprise Service (DES) via improper agent authentication (T1210) and allows full impersonation of legitimate DriveLock agents (T1656).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires authentication of devices such as DriveLock agents before establishing connections with the DES, preventing unauthorized impersonation due to incomplete agent authentication.
Mandates establishment and verification of secure configuration settings for agent authentication in the DriveLock tenant, directly addressing the incomplete configuration vulnerability.
Ensures proper management and distribution of authenticators used by DriveLock agents, mitigating risks from improperly configured or weak authentication mechanisms.