← Vulnerability feed

Vulnerability record · CVE-2025-55187 · published 26 September 2025

CVE-2025-55187: Drivelock improper privilege management vulnerability

Drivelock · Drivelock

In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges.

9.9 CVSS 3.1 Critical EPSS 0.45% · top 63.8% CWE-269 · Improper privilege management
9.9CVSS 3.1 base score
0.45%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://drivelock.help/versions/2025_1/web/en/releasenotes/Content/ReleaseNotes_DriveLock/NewRelease/Aenderungen_Patch2. Release Notes
https://drivelock.help/versions/2025_1/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-001-Remot Vendor Advisory
https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-001-Remo Vendor Advisory

Track CVE-2025-55187 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2025-67781Drivelock improper privilege management vulnerabilityAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileg…EPSS 0.28%9.8CVE-2025-67791Drivelock improper authentication vulnerabilityAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentica…EPSS 0.37%9.8CVE-2025-67793Drivelock improper privilege management vulnerabilityAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" …EPSS 0.32%9.6CVE-2025-67787Drivelock cross-site scripting vulnerabilityAn issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a…EPSS 0.26%7.8CVE-2025-67792Drivelock improper privilege management vulnerabilityAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate a DriveL…EPSS 0.14%7.5CVE-2025-67790Drivelock vulnerabilityAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a …EPSS 0.32%6.1CVE-2025-67794Drivelock incorrect permission assignment vulnerabilityAn issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the agent are …EPSS 0.12%5.3CVE-2025-67789Drivelock improper access control vulnerabilityAn issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer co…EPSS 0.22%

Source: NIST National Vulnerability Database (record CVE-2025-55187), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.