CVE-2025-59109 | | | 2026-01-26 | The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interf… |
CVE-2025-59108 | | | 2026-01-26 | By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced. |
CVE-2025-59107 | | | 2026-01-26 | Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided… |
CVE-2025-59106 | High | 8.8 | 2026-01-26 | The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privi… |
CVE-2025-59105 | | | 2026-01-26 | With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Th… |
CVE-2025-59104 | | | 2026-01-26 | With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus… |
CVE-2025-59103 | | | 2026-01-26 | The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it… |
CVE-2025-59102 | | | 2026-01-26 | The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole c… |
CVE-2025-59101 | | | 2026-01-26 | Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as a… |
CVE-2025-59100 | | | 2026-01-26 | The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download is started and the… |
CVE-2025-59099 | | | 2026-01-26 | The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which all… |
CVE-2025-59098 | | | 2026-01-26 | The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket… |
CVE-2025-59097 | | | 2026-01-26 | The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the d… |
CVE-2025-59096 | | | 2026-01-26 | The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as we… |
CVE-2025-59095 | | | 2026-01-26 | The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the… |
CVE-2025-59094 | | | 2026-01-26 | A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it i… |
CVE-2025-59093 | | | 2026-01-26 | Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random valu… |
CVE-2025-59092 | | | 2026-01-26 | An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used for interprocess com… |
CVE-2025-59091 | | | 2026-01-26 | Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server… |
CVE-2025-59090 | | | 2026-01-26 | On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network acces… |
CVE-2024-58311 | Critical | 9.8 | 2025-12-12 | Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit unique identifier… |