CVE-2026-5491

Executive Summary

CVE-2026-5491 is a directory traversal information disclosure vulnerability in DriveLock that affects the web service listening on TCP port 6067. Remote attackers require no authentication to exploit the flaw, which stems from insufficient validation of user-supplied paths in file operations. The vulnerability enables disclosure of sensitive information in the context of the service account and carries a CVSS 7.5 High rating.

Technical Analysis

The vulnerability exists in the DriveLock web service component that accepts unauthenticated requests over TCP port 6067. The root cause is missing sanitization of path parameters before they are passed to file system operations, allowing sequences such as "../" to traverse directories outside the intended web root. This matches CWE-22 path traversal. Because the service runs under a service account, successful traversal can expose files readable by that account without requiring credentials or user interaction. The attack surface is limited to the network-exposed web service endpoint, and the flaw permits read-only access to arbitrary files on the host.

Exploitation Scenarios

An attacker begins by performing reconnaissance to identify DriveLock instances via Shodan or masscan targeting port 6067. Once a target is located, the attacker sends an HTTP request to the web service containing a crafted path parameter that includes directory traversal sequences, for example requesting a resource with a payload such as "file=../../../../etc/passwd" or equivalent application-specific file paths. The web service processes the path without validation and returns the contents of the requested file in the response. The attacker iterates over common sensitive locations such as configuration files, credential stores, or application data directories to extract information. Post-exploitation, the disclosed data can be used for further lateral movement or credential harvesting within the environment.

Impact Assessment

The vulnerability allows remote, unauthenticated disclosure of sensitive files, directly impacting confidentiality with a CVSS high impact subscore while integrity and availability remain unaffected. Affected systems include any DriveLock installation exposing the web service on port 6067. The blast radius is contained to information disclosure but can reveal credentials or configuration details that enable subsequent attacks. With an EPSS score of 0.01539, exploitation remains uncommon, and CISA KEV lists no entries for this issue.

Detection Guidance

Sigma Rule

title: DriveLock Directory Traversal Attempt
id: 8f4c2a1b-9e3d-4f7a-9c2b-1d5e6f7a8b9c
status: experimental
description: Detects directory traversal patterns targeting DriveLock web service on port 6067
logsource:
  category: webserver
  product: DriveLock
detection:
  selection:
    c-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
  condition: selection
fields:
  - client_ip
  - uri_query
level: high

YARA Rule

rule DriveLock_Directory_Traversal {
    meta:
        description = "Detects potential DriveLock path traversal requests"
        author = "valtersit.com"
    strings:
        $path1 = "../" ascii wide
        $path2 = "..%2f" ascii wide
        $header = "DriveLock" ascii wide
    condition:
        $header and any of ($path1, $path2)
}

Suricata IDS Rule

alert http any any -> any 6067 (msg:"DriveLock Directory Traversal Attempt"; flow:to_server; http.uri; content:"../"; nocase; sid:20265491; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where destination.port == 6067 and url.path like "*../*"]

Splunk SPL Query

index=web sourcetype=driveLock_logs uri_query IN ("*../*", "*..%2f*") | stats count by src_ip, uri_query

Wazuh OSSEC Rule

<group name="driveLock,">
  <rule id="944170" level="10">
    <if_sid>31101</if_sid>
    <match>../</match>
    <description>DriveLock directory traversal detected on port 6067</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. immediate mitigations: Restrict network access to TCP port 6067 using firewall rules to trusted management networks only. Deploy a reverse proxy or WAF with rules blocking traversal sequences.
2. patch/upgrade steps: Monitor vendor advisories for DriveLock updates; apply any future security patches as soon as released.
3. long-term hardening: Implement input validation and canonicalization on all file path parameters within the web service and run the service under a least-privilege account with minimal file system permissions.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-5491 https://www.zerodayinitiative.com/advisories/ZDI-CAN-28722/ DriveLock vendor security advisories (none published) CISA KEV catalog (no entry) EPSS data from FIRST.org (score 0.01539)