CVE-2025-67793

CVE-2025-67793 is a critical privilege escalation vulnerability affecting DriveLock versions 24.1, 24.2, and 25.1 prior to 25.1.6. It allows users with the "Manage roles and permissions" privilege, typically administrators, to elevate themselves or other users to the Supervisor role via an API call. This vulnerability is rated 9.8 (Critical) on the CVSS scale, indicating a network-exploitable flaw with low attack complexity, requiring no user interaction, and leading to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness and potential interest among security researchers. This issue primarily impacts cloud multi-tenant deployments, with on-premise single-tenant installations generally less affected.