CVE-2025-55187

The vulnerability results from improper privilege management (CWE-269) in DriveLock software. An attacker with only basic user privileges (PR:L) can, through the network (AV:N), without victim interaction (UI:N), cause privilege escalation. The CVSS vector indicates a scope change (S:C), meaning the impact of the attack may extend beyond the directly attacked component and affect other parts of the infrastructure.

An attacker can obtain elevated privileges, leading to complete compromise of confidentiality, integrity, and availability of the system (C:H, I:H, A:H). In practice, this may mean complete system takeover, modification of security configurations, or access to protected resources.

DriveLock should be updated to version 24.1.5, 24.2.6, or 25.1.4 depending on the product branch in use. Details are available in the manufacturer's official security notes (Security Bulletin 25-001) at the addresses indicated in the references.

DriveLock in versions: 24.1.4 (before 24.1.5), 24.2.5 (before 24.2.6), and 25.1.2 (before 25.1.4)