A directory traversal flaw in DriveLock’s web service allows an attacker to read files on the server without authentication. The web service listens on TCP port 4568 by default and does not perform proper validation of user‑supplied paths before file operations. This vulnerability can be exploited remotely, enabling disclosure of sensitive information in the context of the service account. The CVSS score of 5.3 categorizes the impact as moderate, reflecting the risk of confidential data exposure. The weakness is a CWE-22 directory traversal flaw.

The affected product is DriveLock, specifically the DriveLock web service component. No explicit version numbers are listed in the advisory, so all installations that include the susceptible web service are potentially vulnerable. The service operates on TCP port 4568 unless reconfigured by the administrator.

The vulnerability carries a CVSS score of 5.3 and an EPSS of 1.266 %, indicating a moderate severity and a low but nonzero likelihood of exploitation at this time. The flaw is not listed in CISA’s KEV catalog. Attackers can gain access purely through remote connections to the web service, performing directory traversal with no authentication requirement. The weakness is classified as CWE-22, a directory traversal vulnerability that permits accessing files outside the intended directory.