Executive brief
DriveLock Enterprise Service, a platform used for endpoint security and device control, contains a vulnerability that could allow a user with low-level access to gain unauthorized administrative privileges. By sending specially crafted requests to the management web service, an attacker can bypass security restrictions to access sensitive data or modify system settings. This could lead to a full compromise of the security management console and the data it protects.
Technical details
A SQL injection vulnerability exists in the DriveLock Enterprise Service (DES) web service, which typically listens on TCP port 4568. The flaw is located in the translation layer between the custom Resource Query Language (RQL) and the backend SQL database. The application fails to properly validate and sanitize user-supplied RQL strings before using them to construct SQL queries. An authenticated attacker with network access to the web service can inject arbitrary SQL statements, leading to unauthorized data access and privilege escalation. The vendor has released patches in versions 24.2.9, 25.1.7, and 25.2.4.
Affected products
- DriveLock DriveLock Enterprise Service (DES) <= 24.2.8 (fixed in 24.2.9), <= 25.1.6 (fixed in 25.1.7), <= 25.2.3 (fixed in 25.2.4)
Timeline
- 2026-02-06: disclosed: Vulnerability reported to vendor
- 2026-02-06: patched: First published security bulletin by vendor
- 2026-04-15: advisory: Coordinated public release by ZDI