CVE-2025-67789

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-17 · updated 2026-10-13
Weakness: CWE-284

Description

An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of other DriveLock tenants via the DriveLock API.

Affected products

DriveLock: from 24.1 before 24.1.6; from 24.2 before 24.2.7; from 25.1 before 25.1.5 — fixed in 24.1.6, 24.2.7, 25.1.5

How to fix

Upgrade to a fixed version: DriveLock 24.1.6, 24.2.7, 25.1.5. Check the vendor advisory for mitigations.

References

https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-004-DESInfoDisclosure.htm

Get alerted when CVE-2025-67789 or the next vulnerability affects your stack