The vulnerability is a classic SQL injection flaw (CWE‑89) in DriveLock’s web service that listens on TCP port 4568. Because user‑supplied input is concatenated into SQL statements without adequate validation, an authenticated attacker can execute arbitrary SQL commands. By doing so, the attacker can elevate privileges and gain access to resources normally restricted, effectively compromising the confidentiality and integrity of those resources.

DriveLock by DriveLock, any installation that has the web service enabled on the default port 4568. No specific version numbers are provided in the advisory.

The CVSS score of 8.8 indicates high severity. The EPSS score is under 1%, suggesting exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires authenticated access, so an attacker must already possess a valid user account. Once authenticated, the attacker can send crafted requests to the port 4568 service to inject SQL and gain elevated privileges. The attack path is straightforward: authenticated attacker sends malicious string via web service → server executes injected SQL → attacker obtains higher privileges.