CVE-2025-59091— Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-59091
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300
Source: NVD (National Vulnerability Database)
Vulnerability Description
Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically visualize open doors and alerts. However, controlling the Access Managers via this interface is also possible. To send and receive status information, authentication is necessary. The Kaba exos 9300 application contains hard-coded credentials for four different users, which are allowed to login to the datapoint server and receive as well as send information, including commands to open arbitrary doors.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用硬编码的凭证
Source: NVD (National Vulnerability Database)
Vulnerability Title
Dormakaba exos 9300 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dormakaba exos 9300是美国Dormakaba公司的一个出入库控制与安全管理系统。 Dormakaba exos 9300存在安全漏洞，该漏洞源于存在多个硬编码凭证，可能导致登录服务器并发送或接收信息，包括打开任意门的命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dormakaba | Kaba exos 9300 | <4.4.1 manual mitigation needed | - |
II. Public POCs for CVE-2025-59091
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-59091
请登录查看更多情报信息。
- Multiple Critical Vulnerabilities in dormakaba Kaba exos 9300 - SEC Consultthird-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-59091
Same Patch Batch · dormakaba · 2026-01-26 · 20 CVEs total
| CVE-2025-59105 | Unencrypted Flash Storage in dormakaba access manager | |
| CVE-2025-59098 | Trace Functionality Leaking Sensitive Data in dormakaba access manager | |
| CVE-2025-59090 | Unauthenticated SOAP API in dormakaba Kaba exos 9300 | |
| CVE-2025-59104 | Unlocked Bootloader in dormakaba access manager | |
| CVE-2025-59095 | Hard-coded Key for PIN Encryption in dormakaba Kaba exos 9300 | |
| CVE-2025-59107 | Static Firmware Encryption Password in dormakaba access manager | |
| CVE-2025-59094 | Local Privilege Escalation in dormakaba Kaba exos 9300 System management | |
| CVE-2025-59102 | Secrets Stored in Plaintext in Database in dormakaba access manager | |
| CVE-2025-59092 | Unauthenticated RPC Service in dormakaba Kaba exos 9300 | |
| CVE-2025-59099 | Unauthenticated Path Traversal in dormakaba access manager | |
| CVE-2025-59097 | Unauthenticated SOAP API in dormakaba access manager | |
| CVE-2025-59106 | Web Server Running with Root Privileges in dormakaba access manager | |
| CVE-2025-59096 | Weak Default Password in dormakaba Kaba exos 9300 | |
| CVE-2025-59109 | UART Leaking Sensitive Data in dormakaba registration unit 9002 | |
| CVE-2025-59093 | Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 93 | |
| CVE-2025-59101 | Insufficient Session Management in dormakaba access manager | |
| CVE-2025-59100 | Unauthenticated Access to the SQLite Database in dormakaba access manager | |
| CVE-2025-59103 | Weak Default Passwords for SSH Access in dormakaba access manager | |
| CVE-2025-59108 | Weak Default Passwords in dormakaba access manager |
IV. Related Vulnerabilities
Same product: Kaba exos 9300
- CVE-2025-59096
Weak Default Password in dormakaba Kaba exos 9300 - CVE-2025-59095
Hard-coded Key for PIN Encryption in dormakaba Kaba exos 930 - CVE-2025-59094
Local Privilege Escalation in dormakaba Kaba exos 9300 Syste - CVE-2025-59093
Insecure Password Derivation Function for Database Administr - CVE-2025-59092
Unauthenticated RPC Service in dormakaba Kaba exos 9300
Same vendor: dormakaba
- CVE-2025-59109
UART Leaking Sensitive Data in dormakaba registration unit 9 - CVE-2025-59108
Weak Default Passwords in dormakaba access manager - CVE-2025-59107
Static Firmware Encryption Password in dormakaba access mana - CVE-2025-59106
Web Server Running with Root Privileges in dormakaba access - CVE-2025-59105
Unencrypted Flash Storage in dormakaba access manager
Same weakness: CWE-798
- CVE-2026-7414
Hardcoded credentials in Yarbo robot firmware - CVE-2026-8032
PicoTronica e-Clinic Healthcare System ECHS echs.js hard-cod - CVE-2026-32834
Easy PayPal Events & Tickets 1.3 Authentication Bypass via Q - CVE-2026-42376
D-Link DIR-456U A1 Hardcoded Telnet Backdoor Credentials - CVE-2026-42375
D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials
V. Comments for CVE-2025-59091
No comments yet