CVE-2025-59095— Hard-coded Key for PIN Encryption in dormakaba Kaba exos 9300
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-59095
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hard-coded Key for PIN Encryption in dormakaba Kaba exos 9300
Source: NVD (National Vulnerability Database)
Vulnerability Description
The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption technique combined with a cryptographic key (cryptoKey) to transform each character of the input string. However, it's important to note that this implementation does not provide strong encryption and should not be considered secure for sensitive data. It's more of a custom encryption approach rather than a common algorithm used in cryptographic applications. The key itself is static and based on the founder's name of the company. The functionality is for example used to encrypt the user PINs before storing them in the MSSQL database.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用硬编码的凭证
Source: NVD (National Vulnerability Database)
Vulnerability Title
Dormakaba exos 9300 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Dormakaba exos 9300是美国Dormakaba公司的一个出入库控制与安全管理系统。 Dormakaba exos 9300存在安全漏洞，该漏洞源于程序库和二进制文件中包含多个硬编码密钥，且加密算法薄弱，可能导致敏感数据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| dormakaba | Kaba exos 9300 | <4.3.3 | - |
II. Public POCs for CVE-2025-59095
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-59095
请登录查看更多情报信息。
- Multiple Critical Vulnerabilities in dormakaba Kaba exos 9300 - SEC Consultthird-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-59095
Same Patch Batch · dormakaba · 2026-01-26 · 20 CVEs total
| CVE-2025-59105 | Unencrypted Flash Storage in dormakaba access manager | |
| CVE-2025-59091 | Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 930 | |
| CVE-2025-59098 | Trace Functionality Leaking Sensitive Data in dormakaba access manager | |
| CVE-2025-59090 | Unauthenticated SOAP API in dormakaba Kaba exos 9300 | |
| CVE-2025-59104 | Unlocked Bootloader in dormakaba access manager | |
| CVE-2025-59107 | Static Firmware Encryption Password in dormakaba access manager | |
| CVE-2025-59094 | Local Privilege Escalation in dormakaba Kaba exos 9300 System management | |
| CVE-2025-59102 | Secrets Stored in Plaintext in Database in dormakaba access manager | |
| CVE-2025-59092 | Unauthenticated RPC Service in dormakaba Kaba exos 9300 | |
| CVE-2025-59099 | Unauthenticated Path Traversal in dormakaba access manager | |
| CVE-2025-59097 | Unauthenticated SOAP API in dormakaba access manager | |
| CVE-2025-59106 | Web Server Running with Root Privileges in dormakaba access manager | |
| CVE-2025-59096 | Weak Default Password in dormakaba Kaba exos 9300 | |
| CVE-2025-59109 | UART Leaking Sensitive Data in dormakaba registration unit 9002 | |
| CVE-2025-59093 | Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 93 | |
| CVE-2025-59101 | Insufficient Session Management in dormakaba access manager | |
| CVE-2025-59100 | Unauthenticated Access to the SQLite Database in dormakaba access manager | |
| CVE-2025-59103 | Weak Default Passwords for SSH Access in dormakaba access manager | |
| CVE-2025-59108 | Weak Default Passwords in dormakaba access manager |
IV. Related Vulnerabilities
Same product: Kaba exos 9300
- CVE-2025-59096
Weak Default Password in dormakaba Kaba exos 9300 - CVE-2025-59094
Local Privilege Escalation in dormakaba Kaba exos 9300 Syste - CVE-2025-59093
Insecure Password Derivation Function for Database Administr - CVE-2025-59092
Unauthenticated RPC Service in dormakaba Kaba exos 9300 - CVE-2025-59091
Hardcoded Legacy Accounts Allowing Control Over Access Manag
Same vendor: dormakaba
- CVE-2025-59109
UART Leaking Sensitive Data in dormakaba registration unit 9 - CVE-2025-59108
Weak Default Passwords in dormakaba access manager - CVE-2025-59107
Static Firmware Encryption Password in dormakaba access mana - CVE-2025-59106
Web Server Running with Root Privileges in dormakaba access - CVE-2025-59105
Unencrypted Flash Storage in dormakaba access manager
Same weakness: CWE-798
- CVE-2026-7414
Hardcoded credentials in Yarbo robot firmware - CVE-2026-8032
PicoTronica e-Clinic Healthcare System ECHS echs.js hard-cod - CVE-2026-32834
Easy PayPal Events & Tickets 1.3 Authentication Bypass via Q - CVE-2026-42376
D-Link DIR-456U A1 Hardcoded Telnet Backdoor Credentials - CVE-2026-42375
D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials
V. Comments for CVE-2025-59095
No comments yet