---
id: CVE-2025-67789
title: >-
  An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7,
  and 25.1 before 25.1.5
summary: >-
  An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7,
  and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of
  other DriveLock tenants via the DriveLock API.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-284
vendor: drivelock
product: drivelock
affected:
  - 'drivelock >= 24.1, < 24.1.6'
  - 'drivelock >= 24.2, < 24.2.7'
  - 'drivelock >= 25.1, < 25.1.5'
patched:
  - drivelock 25.1.5
published: '2025-12-17'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T11:10:00.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67789'
references:
  - url: >-
      https://drivelock.help/versions/current/web/en/releasenotes/Content/ReleaseNotes_DriveLock/SecurityBulletins/25-004-DESInfoDisclosure.htm
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00222
epssPercentile: 0.11805
ingestedAt: '2026-10-13T11:23:51.126Z'
---

## Overview

An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of other DriveLock tenants via the DriveLock API.

## Affected

- `drivelock >= 24.1, < 24.1.6`
- `drivelock >= 24.2, < 24.2.7`
- `drivelock >= 25.1, < 25.1.5`

## Remediation

Upgrade past the affected range:

- `drivelock 25.1.5`