CVE-2026-5489: DriveLock Path Traversal Vulnerability

CVE-2026-5489 Overview

CVE-2026-5489 is a directory traversal vulnerability in DriveLock that allows remote, unauthenticated attackers to disclose sensitive information from affected installations. The flaw resides in the DriveLock web service, which listens on TCP port 4568 by default. The service fails to properly validate user-supplied paths before using them in file operations, enabling attackers to read files accessible to the service account. The issue is tracked as ZDI-CAN-28719 and was published through the Zero Day Initiative as advisory ZDI-26-285. It is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Remote attackers can read files on affected DriveLock installations without authentication, exposing sensitive data in the context of the DriveLock service account.

Affected Products

DriveLock (web service component listening on TCP port 4568)
See the DriveLock Security Bulletin for the specific affected version ranges
Refer to ZDI-26-285 for additional product context

Discovery Timeline

2026-07-29 - CVE-2026-5489 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-5489

Vulnerability Analysis

The vulnerability exists in a DriveLock web service exposed on TCP port 4568. The service accepts a user-supplied path parameter and passes it into file operations without normalizing or restricting the path to an intended base directory. An unauthenticated remote attacker can supply traversal sequences such as ../ to escape the intended directory and read arbitrary files reachable by the service account.

Because authentication is not required, any network-reachable attacker can send crafted HTTP requests to the listening service and retrieve file contents. The scope is limited to confidentiality; the vulnerability does not directly grant write access or code execution. However, disclosed contents may include configuration files, credentials, or internal telemetry that enable follow-on attacks.

The EPSS model places exploitation probability at 1.266% (66.8th percentile) as of the enrichment date.

Root Cause

The root cause is missing canonicalization and validation of a user-supplied path prior to file access [CWE-22]. The service constructs a file path directly from attacker-controlled input and opens the resulting file without verifying that the resolved path remains within the expected directory boundary.

Attack Vector

The attack vector is network-based. An attacker sends a crafted request to the DriveLock web service on TCP port 4568 containing directory traversal sequences in the path parameter. No user interaction and no credentials are required. The response returns file contents readable by the DriveLock service account, which typically runs with elevated local privileges.

Technical details are described in the Zero Day Initiative Advisory ZDI-26-285 and the corresponding DriveLock Security Bulletin. No verified public proof-of-concept code is currently available.

Detection Methods for CVE-2026-5489

Indicators of Compromise

HTTP requests to TCP port 4568 containing path traversal sequences such as ../, ..\, %2e%2e%2f, or encoded variants
Unexpected outbound responses from the DriveLock web service containing file contents of configuration or system files
Access log entries from unfamiliar source IP addresses targeting the DriveLock DES forwarding endpoint
Read attempts by the DriveLock service account on files outside its normal working directories

Detection Strategies

Deploy network intrusion detection signatures that inspect requests to port 4568 for traversal patterns and URL-encoded variants
Correlate DriveLock service account file access telemetry against a baseline of expected paths
Alert on any external or non-management network source communicating with the DriveLock web service

Monitoring Recommendations

Ingest DriveLock web service and Windows file access logs into a centralized SIEM for correlation
Monitor for high-volume or sequential file read attempts originating from the DriveLock service process
Track network flows to port 4568 and alert on requests from outside authorized administrative subnets

How to Mitigate CVE-2026-5489

Immediate Actions Required

Apply the vendor update referenced in the DriveLock Security Bulletin 26-001 as soon as it is available in your environment
Restrict network access to TCP port 4568 to trusted management hosts using host and network firewall rules
Audit the DriveLock service account permissions and remove access to files that are not required for its function
Review web service and file access logs for prior exploitation attempts using traversal sequences

Patch Information

DriveLock has published guidance and remediation details in the DriveLock Security Bulletin 26-001-DESForwarding. Administrators should review the bulletin for fixed version numbers and apply the corresponding update. The vulnerability is also documented by the Zero Day Initiative as ZDI-26-285.

Workarounds

Block TCP port 4568 at the perimeter and internal firewalls where the DES forwarding feature is not required
Restrict access to the DriveLock web service to a dedicated management VLAN or via VPN only
Run the DriveLock service under an account with the minimum file system privileges required for operation

bash

# Example: restrict access to DriveLock web service port 4568 on Windows
netsh advfirewall firewall add rule name="DriveLock 4568 - Allow Mgmt Subnet" \
  dir=in action=allow protocol=TCP localport=4568 \
  remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="DriveLock 4568 - Block All Others" \
  dir=in action=block protocol=TCP localport=4568