---

Security Bulletin #26-008 - NTLM Hash Exposure via Proxy Configuration

---

---

First published: 2026-04-16

Last updated: 2026-07-06

CVE: Not yet assigned

EUVD: Not yet assigned

CVSS Score: 7.9 - AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Affected product(s): DriveLock SE - On-Premise

Affected deployment: DriveLock On-Premise only

DriveLock Cloud: Not affected

Disclosure status: Coordinated

Vulnerability type / classification: Credential Exposure / Improper Authorization

Attack type: Remote

Attack vector: Proxy configuration with NTLM authentication

---

Summary

The DES service user NTLMv2 hash could be leaked if an attacker configured a proxy using NTLM authentication.

Description

The DES service user NTLMv2 hash could be leaked if an attacker configured a proxy with NTLM authentication.

The attack is prevented in two ways. First, the function used to test proxy settings no longer accepts user input. Second, the permissions required to set proxy settings have been increased so that Supervisor permissions are now required.

Affected versions

• DriveLock 24.2 — vulnerable

• DriveLock 25.1 — vulnerable

• DriveLock 25.2 — vulnerable

Mitigation

Update to the patched versions once available. Until the update is applied, ensure that permissions to configure proxy settings are assigned only to trusted administrative users who require this level of access.

Fixed in

• DriveLock 24.2

• DriveLock 25.1

• DriveLock 25.2

• DriveLock 26.1

Credits

This vulnerability was discovered by stuxxn working with CCC

How to update your environment

To ensure continued protection, update to one of the fixed versions listed above. Additionally, we always recommend using the latest available DriveLock release to benefit from ongoing improvements and security enhancements.

---