GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    3 vulnerabilities by Dormakaba

    GCVE-1988-2026-0190

    Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 13:31
    VLAI
    Title
    SEC Consult SA-20260126-0 :: Multiple Critical Vulnerabilities in dormakaba Kaba exos 9300
    Summary
    SEC Consult Vulnerability Lab Security Advisory < 20260126-0 > ======================================================================= title: Multiple Critical Vulnerabilities product: dormakaba Kaba exos 9300 vulnerable version: < 4.4.1 fixed version: 4.4.1 CVE number: CVE-2025-59090, CVE-2025-59091, CVE-2025-59092 CVE-2025-59093, CVE-2025-59094, CVE-2025-59095 CVE-2025-59096              impact: critical homepage:https://www.dormakaba.com/ found: 2024-03-18 by: Clemens Stockenreitner (Office Vienna) Werner Schober (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "The Kaba exos 9300 basic system is the cornerstone of your access management solution. Use it to resolves all your basic employees, system, user and peripheral management tasks and initiate targeted security measures as required. [...] " Source:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000 Business recommendation: ------------------------ The vendor provides multiple patches which should be installed immediately. More details can be found at the following locations: - Solution at the end of this advisory - SEC Consult blog post:https://r.sec-consult.com/dormakaba - Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories - Your dormakaba partner Tested Architecture Overview ----------------------------------- The tested system is the enterprise grade physical access system from dormakaba. The tested system consists of the following components: ------------------------------ dormakaba exos 9300 ------------------------------ Exos 9300 is a piece of software based on C# running on a central Windows server with an MSSQL, or Oracle database as central storage. Exos consists of multiple modules (e.g. basis, employee management, key depot, access, visitor management, 3rd party management). Exos is used to centrally manage users, keys, cards as well as the configuration of the access manager. Devices in the exos environment are addressed using a special addressing scheme. The address scheme described in the following table is going to be important. ┌────────────────────┬───────────────────────────┬───────────────┬───────────────────────────────────────────┬───────────────────────────┬───────────────────┐ │ I │ 01 │ 00 │ 01 │ 00 │ 00 │ ├────────────────────┼───────────────────────────┼───────────────┼───────────────────────────────────────────┼───────────────────────────┼───────────────────┤ │ Port Type │ Communication Hub Address │ Port Address │ Access Hub Address │ 00 = Door Manager │ Datapoint Address │ │ I = Access Manager │ Values: 01-99 │ Values: 00-99 │ Values: 00-99 │ 01 = Access Point │ Values: 00-20 │ │ B = Serial │ │ │ Fixed to 01 for Access Hubs with Ethernet │ 02 = Turnstile │ │ │ C = Modem │ │ │ │ 03 = IO Controller │ │ │ E = Ethernet │ │ │ │ Fixed to 00 in most cases │ │ │ R = remote │ │ │ │ │ │ └────────────────────┴───────────────────────────┴───────────────┴───────────────────────────────────────────┴───────────────────────────┴───────────────────┘ ------------------------------ dormakaba Access Manager ------------------------------ The access manager is a component that is configured via exos. The configuration between exos and access manager is exchanged via a SOAP interface. Per default the data exchange is unencrypted. Encryption is only available starting with access manager hardware release K7. The access manager is a custom piece of hardware with multiple inputs and outputs. The device offers the following interfaces: - Digital Inputs - 3x DC Output Relays - 2x RS-232 - 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125) - 1x RJ45 - 1x Micro USB - 2x Coax (Used to connect registration units e.g. 9001, 9002) The tested hardware was an access manager 9200-k5 running Windows CE embedded, and an access manager 9200-k7 running Linux. ------------------------------ dormakaba Registration Unit ------------------------------ dormakaba registration units can be either a Legic/Mifare card reader, or a PIN pad used to enter a PIN to deactivate alarming systems, or as an additional authentication. ------------------------------ Electric lock ------------------------------ The lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock is simply controlled via a relay contact connected to the access manager. As soon as a user successfully authenticates with a registration unit, the relay connected to the lock is switched and the door opens. The system is depicted in the following diagram. ┌─────────┐ │ │ │exos 9300│ ┌──────────┐ ┌──────────┐ │ │ │ Reg Unit │ │ Pin Pad │ └────┬────┘ │ ┌──┐ │ │ x x x │ │ │ │┼┼│ │ │ x x x │ Ethernet──────►│ │ └──┘ │ │ x x x │ │ │ 9001 │ │ 9002 │ ┌────┴────┐ └─────┬────┘ └─────┬────┘ │ Access │ │ │ │ Manager ├────────────────────┴─────────────┘ │ 9200 │ ▲ └────┬────┘ │ │ Coax │ DC Relay───► │ │ ┌──┴──┐ │ │ │ │ │ │ │ ─┤◄──────Electric Lock │ │ │ │ └─────┘ Vulnerability overview/description: ----------------------------------- 1) Unauthenticated SOAP API (CVE-2025-59090) On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards. 2) Hardcoded Legacy Accounts Allowing Control Over Access Managers (CVE-2025-59091) Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the access manager. This information, among other things, is used to graphically visualize open doors and alerts. However, controlling the access managers via this interface is also possible. To send and receive status information, authentication is necessary. The Kaba exos 9300 application contains hard-coded credentials for four different users, which are allowed to login to the datapoint server and receive as well as send information, including commands to open arbitrary doors. 3) Unauthenticated RPC Service (CVE-2025-59092) An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used for interprocess communication between services and the Kaba exos 9300 GUI, containing status information about the access managers. Interacting with the service does not require any authentication. Therefore, it is possible to send arbitrary status information about door contacts etc. without prior authentication. 4) Insecure Password Derivation Function for Database Administrator (CVE-2025-59093) Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from the registry. This allows an attacker to derive the database password and get authenticated access to the central exos 9300 database as the user "Exos9300Common". The user has the roles "ExosDialog" and "ExosDialogDotNet" assigned, which are able to read most tables of the database as well as update and insert into many tables. 5) Local Privilege Escalation in exos 9300 System management (CVE-2025-59094) A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specified executable should be run with SYSTEM privileges. 6) Hard-coded Key for PIN Encryption (CVE-2025-59095) The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption technique combined with a cryptographic key (cryptoKey) to transform each character of the input string. However, it's important to note that this implementation does not provide strong encryption and should not be considered secure for sensitive data. It's more of a custom encryption approach rather than a common algorithm used in cryptographic applications. The key itself is static and based on the founder's name of the company. The functionality is for example used to encrypt the user PINs before storing them in the MSSQL database. 7) Weak Default Password (CVE-2025-59096) The default password for the extended admin user mode in the application U9ExisAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as well as documented in the locally stored user documentation. Proof of concept: ----------------- 1) Unauthenticated SOAP API (CVE-2025-59090) To create arbitrary access log entries, the following request can be sent to the exos 9300 server on port 8002: ------Request-------- POST /IIdmm2CommunicationHubService HTTP/1.1 Host: <exos IP>:8002 User-Agent: gSOAP/2.8 Content-Type: application/soap+xml; charset=utf-8; action="http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent"; Content-Length: 984 Connection: keep-alive SOAPAction:"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent"; <?xml version="1.0" encoding="UTF-8"?> <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://www.w3.org/2003/05/soap-envelope"; xmlns:SOAP-ENC="http://www.w3.org/2003/05/soap-encoding"; xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xmlns:xsd="http://www.w3.org/2001/XMLSchema"; xmlns:arr="http://schemas.microsoft.com/2003/10/Serialization/Arrays"; xmlns:ns2="http://kbr.kaba.ch/services/ICommunicationHub2IdmmService"; xmlns:ns1="http://kbr.kaba.ch/services/IIdmm2CommunicationHubService";> <SOAP-ENV:Body> <ns1:SetAccessEvent> <ns1:identifier>I010001</ns1:identifier> <ns1:accessEvent> <ns1:BadgeNr>00000000000000061337</ns1:BadgeNr> <ns1:DeviceStatus>1</ns1:DeviceStatus> <ns1:EventId>10</ns1:EventId> <ns1:LogDate>2025-01-01T13:37:00.0000000</ns1:LogDate> <ns1:RegistrationUnitInd
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    SEC Consult Vulnerability Lab via Fulldisclosure
    Relationships
    analysis GCVE-1988-2026-0190 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260126-0",
          "vendor": "Dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260126-0 \u003e\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: dormakaba Kaba exos 9300\n vulnerable version: \u003c 4.4.1\n      fixed version: 4.4.1\n         CVE number: CVE-2025-59090, CVE-2025-59091, CVE-2025-59092\n                     CVE-2025-59093, CVE-2025-59094, CVE-2025-59095\n                     CVE-2025-59096\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://www.dormakaba.com/\n              found: 2024-03-18\n                 by: Clemens Stockenreitner (Office Vienna)\n                     Werner Schober (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The Kaba exos 9300 basic system is the cornerstone of your access\nmanagement solution. Use it to resolves all your basic employees,\nsystem, user and peripheral management tasks and initiate targeted\nsecurity measures as required. [...] \"\n\nSource:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides multiple patches which should be installed immediately.\nMore details can be found at the following locations:\n- Solution at the end of this advisory\n- SEC Consult blog post:https://r.sec-consult.com/dormakaba\n- Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories\n- Your dormakaba partner\n\n\nTested Architecture Overview\n-----------------------------------\nThe tested system is the enterprise grade physical access system from\ndormakaba. The tested system consists of the following components:\n\n------------------------------\ndormakaba exos 9300\n------------------------------\nExos 9300 is a piece of software based on C# running on a central Windows server with\nan MSSQL, or Oracle database as central storage.\nExos consists of multiple modules (e.g. basis, employee management, key depot, access,\nvisitor management, 3rd party management). Exos is used to centrally manage users,\nkeys, cards as well as the configuration of the access manager. Devices in the\nexos environment are addressed using a special addressing scheme. The address scheme\ndescribed in the following table is going to be important.\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502         I          \u2502            01             \u2502      00       \u2502                    01                     \u2502          \n  00             \u2502        00         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Port Type          \u2502 Communication Hub Address \u2502 Port Address  \u2502 Access Hub Address                        \u2502 00 = \nDoor Manager         \u2502 Datapoint Address \u2502\n\u2502 I = Access Manager \u2502 Values: 01-99             \u2502 Values: 00-99 \u2502 Values: 00-99                             \u2502 01 = \nAccess Point         \u2502 Values: 00-20     \u2502\n\u2502 B = Serial         \u2502                           \u2502               \u2502 Fixed to 01 for Access Hubs with Ethernet \u2502 02 = \nTurnstile            \u2502                   \u2502\n\u2502 C = Modem          \u2502                           \u2502               \u2502                                           \u2502 03 = IO \nController        \u2502                   \u2502\n\u2502 E = Ethernet       \u2502                           \u2502               \u2502                                           \u2502 Fixed to \n00 in most cases \u2502                   \u2502\n\u2502 R = remote         \u2502                           \u2502               \u2502                                           \u2502          \n                 \u2502                   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n------------------------------\ndormakaba Access Manager\n------------------------------\nThe access manager is a component that is configured via exos. The configuration\nbetween exos and access manager is exchanged via a SOAP interface. Per default\nthe data exchange is unencrypted. Encryption is only available starting with\naccess manager hardware release K7.\n\nThe access manager is a custom piece of hardware with multiple inputs and outputs.\nThe device offers the following interfaces:\n- Digital Inputs\n- 3x DC Output Relays\n- 2x RS-232\n- 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125)\n- 1x RJ45\n- 1x Micro USB\n- 2x Coax (Used to connect registration units e.g. 9001, 9002)\n\nThe tested hardware was an access manager 9200-k5 running Windows CE embedded,\nand an access manager 9200-k7 running Linux.\n\n------------------------------\ndormakaba Registration Unit\n------------------------------\ndormakaba registration units can be either a Legic/Mifare card reader,\nor a PIN pad used to enter a PIN to deactivate alarming systems, or as\nan additional authentication.\n\n------------------------------\nElectric lock\n------------------------------\nThe lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock\nis simply controlled via a relay contact connected to the access manager. As\nsoon as a user successfully authenticates with a registration unit,\nthe relay connected to the lock is switched and the door opens.\n\nThe system is depicted in the following diagram.\n\n          \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502\n          \u2502exos 9300\u2502              \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502              \u2502 Reg Unit \u2502  \u2502 Pin Pad  \u2502\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518              \u2502   \u250c\u2500\u2500\u2510   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   \u2502\u253c\u253c\u2502   \u2502  \u2502  x x x   \u2502\nEthernet\u2500\u2500\u2500\u2500\u2500\u2500\u25ba\u2502                   \u2502   \u2514\u2500\u2500\u2518   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   9001   \u2502  \u2502   9002   \u2502\n          \u250c\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2510              \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518  \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518\n          \u2502 Access  \u2502                    \u2502             \u2502\n          \u2502 Manager \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n          \u2502  9200   \u2502        \u25b2\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518        \u2502\n               \u2502           Coax\n               \u2502\n  DC Relay\u2500\u2500\u2500\u25ba \u2502\n               \u2502\n            \u250c\u2500\u2500\u2534\u2500\u2500\u2510\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502    \u2500\u2524\u25c4\u2500\u2500\u2500\u2500\u2500\u2500Electric Lock\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2514\u2500\u2500\u2500\u2500\u2500\u2518\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Unauthenticated SOAP API (CVE-2025-59090)\nOn the exos 9300 server, a SOAP API is reachable on port 8002. This API does not\nrequire any authentication prior to sending requests. Therefore, network access\nto the exos server allows e.g. the creation of arbitrary access log events as well\nas querying the 2FA PINs associated with the enrolled chip cards.\n\n2) Hardcoded Legacy Accounts Allowing Control Over Access Managers (CVE-2025-59091)\nMultiple hardcoded credentials have been identified, which are allowed to sign-in\nto the exos 9300 datapoint server running on port 1004 and 1005. This server is\nused for relaying status information from and to the access manager. This information,\namong other things, is used to graphically visualize open doors and alerts. However,\ncontrolling the access managers via this interface is also possible.\nTo send and receive status information, authentication is necessary. The Kaba exos 9300\napplication contains hard-coded credentials for four different users, which are\nallowed to login to the datapoint server and receive as well as send information,\nincluding commands to open arbitrary doors.\n\n3) Unauthenticated RPC Service (CVE-2025-59092)\nAn RPC service, which is part of exos 9300, is reachable on port 4000, run by\nthe process FSMobilePhoneInterface.exe. This service is used for interprocess\ncommunication between services and the Kaba exos 9300 GUI, containing status\ninformation about the access managers. Interacting with the service does not\nrequire any authentication. Therefore, it is possible to send arbitrary status\ninformation about door contacts etc. without prior authentication.\n\n4) Insecure Password Derivation Function for Database Administrator (CVE-2025-59093)\nExos 9300 instances are using a randomly generated database password to connect\nto the configured MSSQL server. The password is derived from static random values,\nwhich are concatenated to the hostname and a random string that can be read by\nevery user from the registry. This allows an attacker to derive the database\npassword and get authenticated access to the central exos 9300 database as the\nuser \"Exos9300Common\". The user has the roles \"ExosDialog\" and \"ExosDialogDotNet\"\nassigned, which are able to read most tables of the database as well as update\nand insert into many tables.\n\n5) Local Privilege Escalation in exos 9300 System management (CVE-2025-59094)\nA local privilege escalation vulnerability has been identified in the\nKaba exos 9300 System management application (d9sysdef.exe). Within this\napplication it is possible to specify an arbitrary executable as well as\nthe weekday and start time, when the specified executable should be run\nwith SYSTEM privileges.\n\n6) Hard-coded Key for PIN Encryption (CVE-2025-59095)\nThe program libraries (DLL) and binaries used by exos 9300 contain multiple\nhard-coded secrets. One notable example is the function \"EncryptAndDecrypt\"\nin the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption\ntechnique combined with a cryptographic key (cryptoKey) to transform each\ncharacter of the input string. However, it\u0027s important to note that this\nimplementation does not provide strong encryption and should not be considered\nsecure for sensitive data. It\u0027s more of a custom encryption approach rather\nthan a common algorithm used in cryptographic applications. The key itself is\nstatic and based on the founder\u0027s name of the company. The functionality is\nfor example used to encrypt the user PINs before storing them in the MSSQL\ndatabase.\n\n7) Weak Default Password (CVE-2025-59096)\nThe default password for the extended admin user mode in the application\nU9ExisAdmin.exe (\"Kaba 9300 Administration\") is hard-coded in multiple\nlocations as well as documented in the locally stored user documentation.\n\n\nProof of concept:\n-----------------\n1) Unauthenticated SOAP API (CVE-2025-59090)\nTo create arbitrary access log entries, the following request can be sent\nto the exos 9300 server on port 8002:\n------Request--------\nPOST /IIdmm2CommunicationHubService HTTP/1.1\nHost: \u003cexos IP\u003e:8002\nUser-Agent: gSOAP/2.8\nContent-Type: application/soap+xml; charset=utf-8; \naction=\"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent\";\nContent-Length: 984\nConnection: keep-alive\nSOAPAction:\"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent\";\n\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cSOAP-ENV:Envelope\n  xmlns:SOAP-ENV=\"http://www.w3.org/2003/05/soap-envelope\";\n  xmlns:SOAP-ENC=\"http://www.w3.org/2003/05/soap-encoding\";\n  xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\";\n  xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\";\n  xmlns:arr=\"http://schemas.microsoft.com/2003/10/Serialization/Arrays\";\n  xmlns:ns2=\"http://kbr.kaba.ch/services/ICommunicationHub2IdmmService\";\n  xmlns:ns1=\"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService\";\u003e\n  \u003cSOAP-ENV:Body\u003e\n    \u003cns1:SetAccessEvent\u003e\n      \u003cns1:identifier\u003eI010001\u003c/ns1:identifier\u003e\n      \u003cns1:accessEvent\u003e\n        \u003cns1:BadgeNr\u003e00000000000000061337\u003c/ns1:BadgeNr\u003e\n        \u003cns1:DeviceStatus\u003e1\u003c/ns1:DeviceStatus\u003e\n        \u003cns1:EventId\u003e10\u003c/ns1:EventId\u003e\n        \u003cns1:LogDate\u003e2025-01-01T13:37:00.0000000\u003c/ns1:LogDate\u003e\n        \u003cns1:RegistrationUnitInd"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:31:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/22"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/22"
        },
        {
          "url": "http://kbr.kaba.ch/services/ICommunicationHub2IdmmService\""
        },
        {
          "url": "http://kbr.kaba.ch/services/IIdmm2CommunicationHubService\""
        },
        {
          "url": "http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/GetPerson\""
        },
        {
          "url": "http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent\""
        },
        {
          "url": "http://schemas.microsoft.com/2003/10/Serialization/Arrays\""
        },
        {
          "url": "http://www.w3.org/2001/XMLSchema\""
        },
        {
          "url": "http://www.w3.org/2001/XMLSchema-instance\""
        },
        {
          "url": "http://www.w3.org/2003/05/soap-encoding\""
        },
        {
          "url": "http://www.w3.org/2003/05/soap-envelope\""
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://r.sec-consult.com/dormakaba"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.dormakaba.com/"
        },
        {
          "url": "https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000"
        },
        {
          "url": "https://www.dormakabagroup.com/en/security-advisories"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/22"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260126-0 :: Multiple Critical Vulnerabilities in dormakaba Kaba exos 9300",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-59090",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59091",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59092",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59093",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59094",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59095",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59096",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0190",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/22",
            "automated": true,
            "contentSha256": "12b4aaf996246ad094c3f964daefe5f4d02a99bdadb4812f6683e101abe33c1c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/22",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-26T10:21:32Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0190"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T13:31:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0190"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0191

    Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 13:32
    VLAI
    Title
    SEC Consult SA-20260126-1 :: Multiple Critical Vulnerabilities in dormakaba Access Manager
    Summary
    SEC Consult Vulnerability Lab Security Advisory < 20260126-1 > ======================================================================= title: Multiple Critical Vulnerabilities product: dormakaba Access Manager vulnerable version: Multiple firmware and hardware revisions (details below) fixed version: Multiple firmware and hardware revisions (details below)          CVE number: CVE-2025-59097, CVE-2025-59098, CVE-2025-59099, CVE-2025-59100, CVE-2025-59101, CVE-2025-59102, CVE-2025-59103, CVE-2025-59104, CVE-2025-59105, CVE-2025-59106, CVE-2025-59107, CVE-2025-59108              impact: critical homepage:https://www.dormakaba.com/ found: 2024-03-18                  by: Clemens Stockenreitner (Office Vienna) Werner Schober (Office Vienna) Supported by the HW Lab Vienna SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "The Kaba exos 9300 basic system is the cornerstone of your access management solution. Use it to resolves all your basic employees, system, user and peripheral management tasks and initiate targeted security measures as required. [...] " Source:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000 Business recommendation: ------------------------ The vendor provides multiple patches which should be installed immediately. More details can be found at the following locations: - Solution at the end of this advisory - SEC Consult blog post:https://r.sec-consult.com/dormakaba - Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories - Your dormakaba partner Tested Architecture Overview ----------------------------------- The tested system is the enterprise grade physical access system from dormakaba. The tested system consists of the following components: ------------------------------ dormakaba exos 9300 ------------------------------ Exos 9300 is a piece of software based on C# running on a central Windows server with an MSSQL, or Oracle database as central storage. Exos consists of multiple modules (e.g. basis, employee management, key depot, access, visitor management, 3rd party management). Exos is used to centrally manage users, keys, cards as well as the configuration of the access manager. Devices in the exos environment are addressed using a special addressing scheme. The address scheme described in the following table is going to be important. ┌────────────────────┬───────────────────────────┬───────────────┬───────────────────────────────────────────┬───────────────────────────┬───────────────────┐ │ I │ 01 │ 00 │ 01 │ 00 │ 00 │ ├────────────────────┼───────────────────────────┼───────────────┼───────────────────────────────────────────┼───────────────────────────┼───────────────────┤ │ Port Type │ Communication Hub Address │ Port Address │ Access Hub Address │ 00 = Door Manager │ Datapoint Address │ │ I = Access Manager │ Values: 01-99 │ Values: 00-99 │ Values: 00-99 │ 01 = Access Point │ Values: 00-20 │ │ B = Serial │ │ │ Fixed to 01 for Access Hubs with Ethernet │ 02 = Turnstile │ │ │ C = Modem │ │ │ │ 03 = IO Controller │ │ │ E = Ethernet │ │ │ │ Fixed to 00 in most cases │ │ │ R = remote │ │ │ │ │ │ └────────────────────┴───────────────────────────┴───────────────┴───────────────────────────────────────────┴───────────────────────────┴───────────────────┘ ------------------------------ dormakaba Access Manager ------------------------------ The access manager is a component that is configured via exos. The configuration between exos and access manager is exchanged via a SOAP interface. Per default the data exchange is unencrypted. Encryption is only available starting with access manager hardware release K7. The access manager is a custom piece of hardware with multiple inputs and outputs. The device offers the following interfaces: - Digital Inputs - 3x DC Output Relays - 2x RS-232 - 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125) - 1x RJ45 - 1x Micro USB - 2x Coax (Used to connect registration units e.g. 9001, 9002) The tested hardware was an access manager 9200-k5 running Windows CE embedded, and an access manager 9200-k7 running Linux. ------------------------------ dormakaba Registration Unit ------------------------------ dormakaba registration units can be either a Legic/Mifare card reader, or a PIN pad used to enter a PIN to deactivate alarming systems, or as an additional authentication. ------------------------------ Electric lock ------------------------------ The lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock is simply controlled via a relay contact connected to the Access Manager. As soon as a user successfully authenticates with a registration unit, the relay connected to the lock is switched and the door opens. The system is depicted in the following diagram. ┌─────────┐ │ │ │exos 9300│ ┌──────────┐ ┌──────────┐ │ │ │ Reg Unit │ │ Pin Pad │ └────┬────┘ │ ┌──┐ │ │ x x x │ │ │ │┼┼│ │ │ x x x │ Ethernet──────►│ │ └──┘ │ │ x x x │ │ │ 9001 │ │ 9002 │ ┌────┴────┐ └─────┬────┘ └─────┬────┘ │ Access │ │ │ │ Manager ├────────────────────┴─────────────┘ │ 9200 │ ▲ └────┬────┘ │ │ Coax │ DC Relay───► │ │ ┌──┴──┐ │ │ │ │ │ │ │ ─┤◄──────Electric Lock │ │ │ │ └─────┘ Vulnerability overview/description: ----------------------------------- 1) Unauthenticated SOAP API (CVE-2025-59097) The exos 9300 application can be used to configure access managers (e.g. 9200, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is sent to the selected access manager via SOAP. The SOAP request is sent without any prior authentication or authorization by default. Though authentication and authorization can be configured using IPsec for 9200-K5 devices and mTLS for 9200-K7 devices, it is not enabled by default and must therefore be activated with additional steps. This insecure default allows an attacker with network level access to completely control the whole environment. An attacker is for example easily able to conduct the following tasks without prior authentication: - Re-configure access managers (e.g. remove alarming system requirements) - Freely re-configure the inputs and outputs - Open all connected doors permanently - Open all doors for a defined time interval - Change the admin password - and many more Network level access can be gained due to an insufficient network segmentation as well as missing LAN firewalls. Some devices with an insecure configuration have been identified to be directly exposed to the internet as well. Vulnerable Versions: - 92xx-K5: All versions on the market - 92xx-K7: <BAME 06.00 2) Trace Functionality Leaking Sensitive Data (CVE-2025-59098) The access manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the socket and receive debug information. The data is permanently broadcast on the TCP socket. The socket can be accessed without any authentication or encryption. The transmitted data is based on the set verbosity level. The verbosity level can be set using the HTTP(S) endpoint with the service interface password or with the guessable identifier of the device via the SOAP interface. The transmitted data contains sensitive data like the Card ID as well as all button presses on registration units. This allows an attacker with network level access to retrieve all entered PINs on a registration unit. Vulnerable Versions: - 92xx-K5: <XAMB 04.06.212 - 92xx-K7: <BAME 05.02.156 3) Unauthenticated Path Traversal (CVE-2025-59099) The Access Manager is using the open source web server "CompactWebServer" written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. Hence, it is possible to retrieve all files stored on the file system, including the SQLite database Database.sq3, containing badge information and the corresponding PIN codes. Additionally, when trying to access certain files, the web server crashes and becomes unreachable for about 60 seconds. This can be abused to continuously send the request and cause denial of service. Vulnerable Versions: - 92xx-K5: <XAMB 04.05.21 - 92xx-K7: <BAME 04.05.16 4) Unauthenticated Access to the SQLite Database (CVE-2025-59100) The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download is started and the device reboots. After rebooting, the exported database is deleted and cannot be accessed anymore. However, it was noticed that sometimes the device does not reboot and therefore the exported database is not deleted, or the device reboots and the export is not deleted for unknown reasons. The path where the database export is located can be accessed without prior authentication. This leads to the fact that an attacker might be able to get access to the exported database without prior authentication. The database includes sensitive data like passwords, card pins, encrypted Mifare sitekeys and much more. Vulnerable Versions: - 92xx-K5: <XAMB 04.06.212 5) Insufficient Session Management (CVE-2025-59101) Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface. Vulnerable Versions: - 92xx-K5: <XAMB 04.06.212 - 92xx-K7: <BAME 04.07.268 6) Secrets Stored in Plaintext in Database (CVE-2025-59102) The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The PINs are even stored unencrypted. Combined with the fact that an attacker can e
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    SEC Consult Vulnerability Lab via Fulldisclosure
    Relationships
    analysis GCVE-1988-2026-0191 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260126-1",
          "vendor": "Dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260126-1 \u003e\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: dormakaba Access Manager\n vulnerable version: Multiple firmware and hardware revisions (details below)\n      fixed version: Multiple firmware and hardware revisions (details below)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-59097, CVE-2025-59098, CVE-2025-59099,\n                     CVE-2025-59100, CVE-2025-59101, CVE-2025-59102,\n                     CVE-2025-59103, CVE-2025-59104, CVE-2025-59105,\n                     CVE-2025-59106, CVE-2025-59107, CVE-2025-59108\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://www.dormakaba.com/\n              found: 2024-03-18\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0by: Clemens Stockenreitner (Office Vienna)\n                     Werner Schober (Office Vienna)\n                     Supported by the HW Lab Vienna\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The Kaba exos 9300 basic system is the cornerstone of your access\nmanagement solution. Use it to resolves all your basic employees,\nsystem, user and peripheral management tasks and initiate targeted\nsecurity measures as required. [...] \"\n\nSource:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides multiple patches which should be installed immediately.\nMore details can be found at the following locations:\n- Solution at the end of this advisory\n- SEC Consult blog post:https://r.sec-consult.com/dormakaba\n- Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories\n- Your dormakaba partner\n\n\nTested Architecture Overview\n-----------------------------------\nThe tested system is the enterprise grade physical access system from\ndormakaba. The tested system consists of the following components:\n\n------------------------------\ndormakaba exos 9300\n------------------------------\nExos 9300 is a piece of software based on C# running on a central Windows server with\nan MSSQL, or Oracle database as central storage.\nExos consists of multiple modules (e.g. basis, employee management, key depot, access,\nvisitor management, 3rd party management). Exos is used to centrally manage users,\nkeys, cards as well as the configuration of the access manager. Devices in the\nexos environment are addressed using a special addressing scheme. The address scheme\ndescribed in the following table is going to be important.\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502         I          \u2502            01             \u2502      00       \u2502                    01                     \u2502          \n  00             \u2502        00         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Port Type          \u2502 Communication Hub Address \u2502 Port Address  \u2502 Access Hub Address                        \u2502 00 = \nDoor Manager         \u2502 Datapoint Address \u2502\n\u2502 I = Access Manager \u2502 Values: 01-99             \u2502 Values: 00-99 \u2502 Values: 00-99                             \u2502 01 = \nAccess Point         \u2502 Values: 00-20     \u2502\n\u2502 B = Serial         \u2502                           \u2502               \u2502 Fixed to 01 for Access Hubs with Ethernet \u2502 02 = \nTurnstile            \u2502                   \u2502\n\u2502 C = Modem          \u2502                           \u2502               \u2502                                           \u2502 03 = IO \nController        \u2502                   \u2502\n\u2502 E = Ethernet       \u2502                           \u2502               \u2502                                           \u2502 Fixed to \n00 in most cases \u2502                   \u2502\n\u2502 R = remote         \u2502                           \u2502               \u2502                                           \u2502          \n                 \u2502                   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n------------------------------\ndormakaba Access Manager\n------------------------------\nThe access manager is a component that is configured via exos. The configuration\nbetween exos and access manager is exchanged via a SOAP interface. Per default\nthe data exchange is unencrypted. Encryption is only available starting with\naccess manager hardware release K7.\nThe access manager is a custom piece of hardware with multiple inputs and outputs.\nThe device offers the following interfaces:\n- Digital Inputs\n- 3x DC Output Relays\n- 2x RS-232\n- 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125)\n- 1x RJ45\n- 1x Micro USB\n- 2x Coax (Used to connect registration units e.g. 9001, 9002)\n\nThe tested hardware was an access manager 9200-k5 running Windows CE embedded,\nand an access manager 9200-k7 running Linux.\n\n------------------------------\ndormakaba Registration Unit\n------------------------------\ndormakaba registration units can be either a Legic/Mifare card reader,\nor a PIN pad used to enter a PIN to deactivate alarming systems, or as\nan additional authentication.\n\n------------------------------\nElectric lock\n------------------------------\nThe lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock\nis simply controlled via a relay contact connected to the Access Manager. As\nsoon as a user successfully authenticates with a registration unit,\nthe relay connected to the lock is switched and the door opens.\n\nThe system is depicted in the following diagram.\n\n          \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502\n          \u2502exos 9300\u2502              \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502              \u2502 Reg Unit \u2502  \u2502 Pin Pad  \u2502\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518              \u2502   \u250c\u2500\u2500\u2510   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   \u2502\u253c\u253c\u2502   \u2502  \u2502  x x x   \u2502\nEthernet\u2500\u2500\u2500\u2500\u2500\u2500\u25ba\u2502                   \u2502   \u2514\u2500\u2500\u2518   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   9001   \u2502  \u2502   9002   \u2502\n          \u250c\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2510              \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518  \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518\n          \u2502 Access  \u2502                    \u2502             \u2502\n          \u2502 Manager \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n          \u2502  9200   \u2502        \u25b2\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518        \u2502\n               \u2502           Coax\n               \u2502\n  DC Relay\u2500\u2500\u2500\u25ba \u2502\n               \u2502\n            \u250c\u2500\u2500\u2534\u2500\u2500\u2510\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502    \u2500\u2524\u25c4\u2500\u2500\u2500\u2500\u2500\u2500Electric Lock\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2514\u2500\u2500\u2500\u2500\u2500\u2518\n\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Unauthenticated SOAP API (CVE-2025-59097)\nThe exos 9300 application can be used to configure access managers (e.g. 9200,\n9230 and 9290). The configuration is done in a graphical user interface on the\ndormakaba exos server. As soon as the save button is clicked in exos 9300, the\nwhole configuration is sent to the selected access manager via SOAP. The SOAP\nrequest is sent without any prior authentication or authorization by default.\nThough authentication and authorization can be configured using IPsec for 9200-K5\ndevices and mTLS for 9200-K7 devices, it is not enabled by default and must\ntherefore be activated with additional steps.\n\nThis insecure default allows an attacker with network level access to completely\ncontrol the whole environment. An attacker is for example easily able to conduct\nthe following tasks without prior authentication:\n- Re-configure access managers (e.g. remove alarming system requirements)\n- Freely re-configure the inputs and outputs - Open all connected doors permanently\n- Open all doors for a defined time interval\n- Change the admin password\n- and many more\n\nNetwork level access can be gained due to an insufficient network segmentation as well\nas missing LAN firewalls. Some devices with an insecure configuration have been\nidentified to be directly exposed to the internet as well.\n\nVulnerable Versions:\n- 92xx-K5: All versions on the market\n- 92xx-K7: \u003cBAME 06.00\n\n2) Trace Functionality Leaking Sensitive Data (CVE-2025-59098)\nThe access manager is offering a trace functionality to debug errors and issues\nwith the device. The trace functionality is implemented as a simple TCP socket.\nA tool called TraceClient.exe, provided by dormakaba via the Access Manager web\ninterface, is used to connect to the socket and receive debug information. The data\nis permanently broadcast on the TCP socket. The socket can be accessed without\nany authentication or encryption.\n\nThe transmitted data is based on the set verbosity level. The verbosity level can be\nset using the HTTP(S) endpoint with the service interface password or with the guessable\nidentifier of the device via the SOAP interface.\n\nThe transmitted data contains sensitive data like the Card ID as well as all\nbutton presses on registration units. This allows an attacker with network level\naccess to retrieve all entered PINs on a registration unit.\n\nVulnerable Versions:\n- 92xx-K5: \u003cXAMB 04.06.212\n- 92xx-K7: \u003cBAME 05.02.156\n\n\n3) Unauthenticated Path Traversal (CVE-2025-59099)\nThe Access Manager is using the open source web server \"CompactWebServer\" written\nin C#. This web server is affected by a path traversal vulnerability, which\nallows an attacker to directly access files via simple GET requests without\nprior authentication.\n\nHence, it is possible to retrieve all files stored on the file system, including\nthe SQLite database Database.sq3, containing badge information and the corresponding\nPIN codes. Additionally, when trying to access certain files, the web server crashes\nand becomes unreachable for about 60 seconds. This can be abused to continuously send\nthe request and cause denial of service.\n\nVulnerable Versions:\n- 92xx-K5: \u003cXAMB 04.05.21\n- 92xx-K7: \u003cBAME 04.05.16\n\n4) Unauthenticated Access to the SQLite Database (CVE-2025-59100)\nThe web interface offers a functionality to export the internal SQLite database.\nAfter executing the database export, an automatic download is started and the\ndevice reboots. After rebooting, the exported database is deleted and cannot be\naccessed anymore. However, it was noticed that sometimes the device does not reboot\nand therefore the exported database is not deleted, or the device reboots and the\nexport is not deleted for unknown reasons. The path where the database export is\nlocated can be accessed without prior authentication. This leads to the fact that\nan attacker might be able to get access to the exported database without prior\nauthentication. The database includes sensitive data like passwords, card pins,\nencrypted Mifare sitekeys and much more.\n\nVulnerable Versions:\n- 92xx-K5: \u003cXAMB 04.06.212\n\n5) Insufficient Session Management (CVE-2025-59101)\nInstead of typical session tokens or cookies, it is verified on a per-request basis\nif the originating IP address has once successfully logged in. As soon as an\nauthentication request from a certain source IP is successful, the IP address\nis handled as authenticated. No other session information is stored. Therefore,\nit is possible to spoof the IP address of a logged-in user to gain access to\nthe Access Manager web interface.\n\nVulnerable Versions:\n- 92xx-K5: \u003cXAMB 04.06.212\n- 92xx-K7: \u003cBAME 04.07.268\n\n6) Secrets Stored in Plaintext in Database (CVE-2025-59102)\nThe web server of the Access Manager offers a functionality to download a backup\nof the local database stored on the device. This database contains the whole\nconfiguration. This includes encrypted MIFARE keys, card data, user PINs and\nmuch more. The PINs are even stored unencrypted. Combined with the fact that an\nattacker can e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:32:41Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/23"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/23"
        },
        {
          "url": "http://kbr.kaba.ch/services/ICommunicationHub2IdmmService\""
        },
        {
          "url": "http://kbr.kaba.ch/services/ICommunicationHub2IdmmService/ICommunicationHub2IdmmService/BinaryTimezoneUpdate\""
        },
        {
          "url": "http://kbr.kaba.ch/services/ICommunicationHub2IdmmService/ICommunicationHub2IdmmService/ExecutePassagewayCommand\""
        },
        {
          "url": "http://schemas.microsoft.com/2003/10/Serialization/\""
        },
        {
          "url": "http://www.w3.org/2001/XMLSchema\""
        },
        {
          "url": "http://www.w3.org/2001/XMLSchema-instance\""
        },
        {
          "url": "http://www.w3.org/2003/05/soap-encoding\""
        },
        {
          "url": "http://www.w3.org/2003/05/soap-envelope\""
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://r.sec-consult.com/dormakaba"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.dormakaba.com/"
        },
        {
          "url": "https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000"
        },
        {
          "url": "https://www.dormakabagroup.com/en/security-advisories"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/23"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260126-1 :: Multiple Critical Vulnerabilities in dormakaba Access Manager",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-59097",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59098",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59099",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59100",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59101",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59102",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59103",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59104",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59105",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59106",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59107",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59108",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0191",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/23",
            "automated": true,
            "contentSha256": "57e9688107e04992c6027e9d5f1d85f056573a110cd49d8ac7decd85f4d9fa6f",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/23",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-26T10:21:48Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0191"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T13:32:41Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0191"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0192

    Vulnerability from gna-1988 – Published: 2026-09-08 07:57 – Updated: 2026-09-09 13:32
    VLAI
    Title
    SEC Consult SA-20260126-2 :: UART Leaking Sensitive Data in dormakaba registration unit 9002 (PIN pad)
    Summary
    SEC Consult Vulnerability Lab Security Advisory < 20260126-2 > ======================================================================= title: UART Leaking Sensitive Data             product: dormakaba registration unit 9002 (PIN pad) vulnerable version: <SW0039       fixed version: SW0039          CVE number: CVE-2025-59109              impact: medium homepage:https://www.dormakaba.com/ found: 2024-03-18                  by: Clemens Stockenreitner (Office Vienna) Werner Schober (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "The Kaba exos 9300 basic system is the cornerstone of your access management solution. Use it to resolves all your basic employees, system, user and peripheral management tasks and initiate targeted security measures as required. [...] " Source:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions Business recommendation: ------------------------ The vendor provides an updated hardware revision of the device. More details can be found at the following locations: - Solution at the end of this advisory - SEC Consult blog post:https://r.sec-consult.com/dormakaba - Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories - Your dormakaba partner Tested Architecture Overview ----------------------------------- The tested system is the enterprise grade physical access system from dormakaba. The tested system consists of the following components: ------------------------------ dormakaba exos 9300 ------------------------------ Exos 9300 is a piece of software based on C# running on a central Windows server with an MSSQL, or Oracle database as central storage. Exos consists of multiple modules (e.g. basis, employee management, key depot, access, visitor management, 3rd party management). Exos is used to centrally manage users, keys, cards as well as the configuration of the access manager. Devices in the exos environment are addressed using a special addressing scheme. The address scheme described in the following table is going to be important. ┌────────────────────┬───────────────────────────┬───────────────┬───────────────────────────────────────────┬───────────────────────────┬───────────────────┐ │ I │ 01 │ 00 │ 01 │ 00 │ 00 │ ├────────────────────┼───────────────────────────┼───────────────┼───────────────────────────────────────────┼───────────────────────────┼───────────────────┤ │ Port Type │ Communication Hub Address │ Port Address │ Access Hub Address │ 00 = Door Manager │ Datapoint Address │ │ I = Access Manager │ Values: 01-99 │ Values: 00-99 │ Values: 00-99 │ 01 = Access Point │ Values: 00-20 │ │ B = Serial │ │ │ Fixed to 01 for Access Hubs with Ethernet │ 02 = Turnstile │ │ │ C = Modem │ │ │ │ 03 = IO Controller │ │ │ E = Ethernet │ │ │ │ Fixed to 00 in most cases │ │ │ R = remote │ │ │ │ │ │ └────────────────────┴───────────────────────────┴───────────────┴───────────────────────────────────────────┴───────────────────────────┴───────────────────┘ ------------------------------ dormakaba Access Manager ------------------------------ The access manager is a component that is configured via exos. The configuration between exos and access manager is exchanged via a SOAP interface. Per default the data exchange is unencrypted. Encryption is only available starting with access manager hardware release K7. The access manager is a custom piece of hardware with multiple inputs and outputs. The device offers the following interfaces: - Digital Inputs - 3x DC Output Relays - 2x RS-232 - 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125) - 1x RJ45 - 1x Micro USB - 2x Coax (Used to connect registration units e.g. 9001, 9002) The tested hardware was an access manager 9200-k5 running Windows CE embedded, and an access manager 9200-k7 running Linux. ------------------------------ dormakaba Registration Unit ------------------------------ Dormakaba registration units can be either a Legic/Mifare card reader, or a PIN pad used to enter a PIN to deactivate alarming systems, or as an additional authentication. ------------------------------ Electric lock ------------------------------ The lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock is simply controlled via a relay contact connected to the access manager. As soon as a user successfully authenticates with a registration unit, the relay connected to the lock is switched and the door opens. The system is depicted in the following diagram. ┌─────────┐ │ │ │exos 9300│ ┌──────────┐ ┌──────────┐ │ │ │ Reg Unit │ │ Pin Pad │ └────┬────┘ │ ┌──┐ │ │ x x x │ │ │ │┼┼│ │ │ x x x │ Ethernet──────►│ │ └──┘ │ │ x x x │ │ │ 9001 │ │ 9002 │ ┌────┴────┐ └─────┬────┘ └─────┬────┘ │ Access │ │ │ │ Manager ├────────────────────┴─────────────┘ │ 9200 │ ▲ └────┬────┘ │ │ Coax │ DC Relay───► │ │ ┌──┴──┐ │ │ │ │ │ │ │ ─┤◄──────Electric Lock │ │ │ │ └─────┘ Vulnerability overview/description: ----------------------------------- 1) UART Leaking Sensitive Data (CVE-2025-59109) The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an attacker is easily able to remove the device, install a hardware implant which connects to the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi). Proof of concept: ----------------- 1) UART Leaking Sensitive Data (CVE-2025-59109) To verify that the UART interface actually sends the entered numbers, wires have been soldered to the board of the keypad. Using a baud rate of 57.600, one stop bit and no parity bits, the data keystrokes can be received. The received output then includes the pressed keys, and the coordinates of the pressed key in the following format. 1,1324,0395, 5,1294,0386, 8,1290,0398, 6,1294,0388, 6,1294,0403, E,1304,0374, Vulnerable / tested versions: ----------------------------- All hardware revisions with a firmware version <SW0039, which was the latest version available at the time of the test, are vulnerable. Vendor contact timeline: ------------------------ 2024-04-02: Contacting vendor throughsecuritysupport () dormakaba com, no response 2024-04-05: Contacting vendor again throughsecuritysupport () dormakaba com, no response 2024-04-09: Contacting vendor again throughinfo () dormakaba com andhelpdesk.awm.ch () dormakaba com 2024-04-09:info () dormakaba com andhelpdesk.awm.ch () dormakaba com informed us that they are not responsible for Austrian "Customers" and we should contact the Austrian dormakaba entity. 2024-04-09: Contacting vendor again throughinfo () dormakaba com,helpdesk.awm.ch () dormakaba com andsecuritysupport () dormakaba com. Explaining that this is not a local Austrian problem, but a global issue for dormakaba. Requesting a Global Security Contact. 2024-04-09: Instead of forwarding our message to the global security team a local Austrian dormakaba representative called us. We closed the call down by requesting a contact of dormakaba's global security team. 2024-04-09: Austrian representatives requests the advisory via E-Mail. Asking for confirmation, if mail encryption is supported or if the advisory shall be forwarded unencrypted. 2024-04-10: Scheduling a conference call with the Austrian contact to clarify everything and explain the security issues. 2024-04-10: Conference call got cancelled. The Austrian contact forwarded our request to the headquarter in Switzerland. 2024-04-10: dormakaba's CISO contacted us via email and informed us to get back to us as soon as possible. 2024-04-12: dormakaba's DVP Systems Access Control und Owner Security Governance contacted us via email and provided us with a secure channel to submit the advisory. The advisory got submitted immediately. 2024-04-12: dormakaba's DVP Systems Access Control und Owner Security Governance requests details about the tested firmware and software version. 2024-04-15: SEC Consult provides detailed software and firmware version that was tested. 2024-04-16: dormakaba updates us and informs us that they are actively investigating the reported issues. 2024-04-30: Asking for a status update & offering a meeting to discuss any questions. 2024-04-30: dormakaba's CISO replies by accepting our meeting offer. Scheduling a meeting for 2024-05-07. 2024-05-07: Meeting with dormakaba's CISO and DVP Systems Access Control. All vulnerabilities are confirmed and actively worked on. Discussing further steps and agreeing on a monthly update meeting with dormakaba. 2024-05-08: Providing further details concerning the vulnerabilities as well as providing a set of questions (Vulnerable Versions, Firmware, Revisions), proposing meeting dates; no response 2024-05-23: Asking for a status update, no response 2024-06-03: Asking again for a status update. 2024-06-04: dormakaba's CISO replies with a meeting invite. 2024-06-05: Meeting with dormakaba for the scheduled monthly update meeting. 2024-07-24: Asking again for a status update, no response. 2024-07-31: Asking again for a status update or meeting, no response. 2024-08-19: Asking again for a status update or meeting. 2024-08-27: Scheduling a call for 2024-09-03 2024-09-03: dormakaba technician provides status update about which vulnerabilities are already fixed in the next release and on which they are still actively working on. 2024-11-12: Asking for a status update and informing dormakaba that we tested a newer hardware release of the dormakaba Access Manager (9200-K7) which is based on Linux. Multiple new critical vulnerabilities were identified. A separate advisory is in the making. 2024-12-12: Meeting with dormakaba to discuss new identified issues in other hardware releases. 2025-01-16: Added vulnerability "Unauthenticated access to the internal SQLite Database" & "Static firmware encryption password", see SEC Consult advisory 20260126-1. 2025-01-17: Providing updated advisory to dormakaba, asking for a status update regarding th
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    SEC Consult Vulnerability Lab via Fulldisclosure
    Relationships
    reference GCVE-1988-2026-0192 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260126-2",
          "vendor": "Dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260126-2 \u003e\n=======================================================================\n              title: UART Leaking Sensitive Data\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: dormakaba registration unit 9002 (PIN pad)\n vulnerable version: \u003cSW0039\n\u00a0 \u00a0 \u00a0 fixed version: SW0039\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-59109\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://www.dormakaba.com/\n              found: 2024-03-18\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0by: Clemens Stockenreitner (Office Vienna)\n                     Werner Schober (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The Kaba exos 9300 basic system is the cornerstone of your access\nmanagement solution. Use it to resolves all your basic employees,\nsystem, user and peripheral management tasks and initiate targeted\nsecurity measures as required. [...] \"\n\nSource:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides an updated hardware revision of the device.\nMore details can be found at the following locations:\n- Solution at the end of this advisory\n- SEC Consult blog post:https://r.sec-consult.com/dormakaba\n- Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories\n- Your dormakaba partner\n\n\nTested Architecture Overview\n-----------------------------------\nThe tested system is the enterprise grade physical access system from\ndormakaba. The tested system consists of the following components:\n\n------------------------------\ndormakaba exos 9300\n------------------------------\nExos 9300 is a piece of software based on C# running on a central Windows server with\nan MSSQL, or Oracle database as central storage.\nExos consists of multiple modules (e.g. basis, employee management, key depot, access,\nvisitor management, 3rd party management). Exos is used to centrally manage users,\nkeys, cards as well as the configuration of the access manager. Devices in the\nexos environment are addressed using a special addressing scheme. The address scheme\ndescribed in the following table is going to be important.\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502         I          \u2502            01             \u2502      00       \u2502                    01                     \u2502          \n  00             \u2502        00         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Port Type          \u2502 Communication Hub Address \u2502 Port Address  \u2502 Access Hub Address                        \u2502 00 = \nDoor Manager         \u2502 Datapoint Address \u2502\n\u2502 I = Access Manager \u2502 Values: 01-99             \u2502 Values: 00-99 \u2502 Values: 00-99                             \u2502 01 = \nAccess Point         \u2502 Values: 00-20     \u2502\n\u2502 B = Serial         \u2502                           \u2502               \u2502 Fixed to 01 for Access Hubs with Ethernet \u2502 02 = \nTurnstile            \u2502                   \u2502\n\u2502 C = Modem          \u2502                           \u2502               \u2502                                           \u2502 03 = IO \nController        \u2502                   \u2502\n\u2502 E = Ethernet       \u2502                           \u2502               \u2502                                           \u2502 Fixed to \n00 in most cases \u2502                   \u2502\n\u2502 R = remote         \u2502                           \u2502               \u2502                                           \u2502          \n                 \u2502                   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n------------------------------\ndormakaba Access Manager\n------------------------------\nThe access manager is a component that is configured via exos. The configuration\nbetween exos and access manager is exchanged via a SOAP interface. Per default\nthe data exchange is unencrypted. Encryption is only available starting with\naccess manager hardware release K7.\nThe access manager is a custom piece of hardware with multiple inputs and outputs.\nThe device offers the following interfaces:\n- Digital Inputs\n- 3x DC Output Relays\n- 2x RS-232\n- 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125)\n- 1x RJ45\n- 1x Micro USB\n- 2x Coax (Used to connect registration units e.g. 9001, 9002)\n\nThe tested hardware was an access manager 9200-k5 running Windows CE embedded,\nand an access manager 9200-k7 running Linux.\n\n------------------------------\ndormakaba Registration Unit\n------------------------------\nDormakaba registration units can be either a Legic/Mifare card reader,\nor a PIN pad used to enter a PIN to deactivate alarming systems, or as\nan additional authentication.\n\n------------------------------\nElectric lock\n------------------------------\nThe lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock\nis simply controlled via a relay contact connected to the access manager. As\nsoon as a user successfully authenticates with a registration unit,\nthe relay connected to the lock is switched and the door opens.\n\nThe system is depicted in the following diagram.\n\n          \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502\n          \u2502exos 9300\u2502              \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502              \u2502 Reg Unit \u2502  \u2502 Pin Pad  \u2502\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518              \u2502   \u250c\u2500\u2500\u2510   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   \u2502\u253c\u253c\u2502   \u2502  \u2502  x x x   \u2502\nEthernet\u2500\u2500\u2500\u2500\u2500\u2500\u25ba\u2502                   \u2502   \u2514\u2500\u2500\u2518   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   9001   \u2502  \u2502   9002   \u2502\n          \u250c\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2510              \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518  \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518\n          \u2502 Access  \u2502                    \u2502             \u2502\n          \u2502 Manager \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n          \u2502  9200   \u2502        \u25b2\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518        \u2502\n               \u2502           Coax\n               \u2502\n  DC Relay\u2500\u2500\u2500\u25ba \u2502\n               \u2502\n            \u250c\u2500\u2500\u2534\u2500\u2500\u2510\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502    \u2500\u2524\u25c4\u2500\u2500\u2500\u2500\u2500\u2500Electric Lock\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2514\u2500\u2500\u2500\u2500\u2500\u2518\n\n\n\nVulnerability overview/description:\n-----------------------------------\n1) UART Leaking Sensitive Data (CVE-2025-59109)\nThe dormakaba registration units 9002 (PIN Pad Units) have an exposed UART\nheader on the backside. The PIN pad is sending every button press to the UART\ninterface. An attacker can use the interface to exfiltrate PINs. As the\ndevices are explicitly built as Plug-and-Play to be easily replaced, an attacker\nis easily able to remove the device, install a hardware implant which connects\nto the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).\n\n\nProof of concept:\n-----------------\n1) UART Leaking Sensitive Data (CVE-2025-59109)\nTo verify that the UART interface actually sends the entered numbers, wires have been\nsoldered to the board of the keypad. Using a baud rate of 57.600, one stop bit and no\nparity bits, the data keystrokes can be received.\n\nThe received output then includes the pressed keys, and the coordinates of the pressed\nkey in the following format.\n\n1,1324,0395,\n5,1294,0386,\n8,1290,0398,\n6,1294,0388,\n6,1294,0403,\nE,1304,0374,\n\n\nVulnerable / tested versions:\n-----------------------------\nAll hardware revisions with a firmware version \u003cSW0039, which was the latest\nversion available at the time of the test, are vulnerable.\n\n\nVendor contact timeline:\n------------------------\n2024-04-02: Contacting vendor throughsecuritysupport () dormakaba com, no response\n2024-04-05: Contacting vendor again throughsecuritysupport () dormakaba com, no response\n2024-04-09: Contacting vendor again throughinfo () dormakaba com andhelpdesk.awm.ch () dormakaba com\n2024-04-09:info () dormakaba com andhelpdesk.awm.ch () dormakaba com informed us\n            that they are not responsible for Austrian \"Customers\" and we should\n            contact the Austrian dormakaba entity.\n2024-04-09: Contacting vendor again throughinfo () dormakaba com,helpdesk.awm.ch () dormakaba com\n            andsecuritysupport () dormakaba com. Explaining that this is not a local\n            Austrian problem, but a global issue for dormakaba. Requesting a Global\n            Security Contact.\n2024-04-09: Instead of forwarding our message to the global security team a local\n            Austrian dormakaba representative called us. We closed the call down by\n            requesting a contact of dormakaba\u0027s global security team.\n2024-04-09: Austrian representatives requests the advisory via E-Mail. Asking for\n            confirmation, if mail encryption is supported or if the advisory\n            shall be forwarded unencrypted.\n2024-04-10: Scheduling a conference call with the Austrian contact to clarify everything\n            and explain the security issues.\n2024-04-10: Conference call got cancelled. The Austrian contact forwarded our request to\n            the headquarter in Switzerland.\n2024-04-10: dormakaba\u0027s CISO contacted us via email and informed us to get back to us\n            as soon as possible.\n2024-04-12: dormakaba\u0027s DVP Systems Access Control und Owner Security Governance contacted\n            us via email and provided us with a secure channel to submit the advisory. The\n            advisory got submitted immediately.\n2024-04-12: dormakaba\u0027s DVP Systems Access Control und Owner Security Governance requests\n            details about the tested firmware and software version.\n2024-04-15: SEC Consult provides detailed software and firmware version that was tested.\n2024-04-16: dormakaba updates us and informs us that they are actively investigating\n            the reported issues.\n2024-04-30: Asking for a status update \u0026 offering a meeting to discuss any questions.\n2024-04-30: dormakaba\u0027s CISO replies by accepting our meeting offer. Scheduling a meeting\n            for 2024-05-07.\n2024-05-07: Meeting with dormakaba\u0027s CISO and DVP Systems Access Control. All vulnerabilities\n            are confirmed and actively worked on. Discussing further steps and agreeing on a\n            monthly update meeting with dormakaba.\n2024-05-08: Providing further details concerning the vulnerabilities as well as\n            providing a set of questions (Vulnerable Versions, Firmware, Revisions), proposing\n            meeting dates; no response\n2024-05-23: Asking for a status update, no response\n2024-06-03: Asking again for a status update.\n2024-06-04: dormakaba\u0027s CISO replies with a meeting invite.\n2024-06-05: Meeting with dormakaba for the scheduled monthly update meeting.\n2024-07-24: Asking again for a status update, no response.\n2024-07-31: Asking again for a status update or meeting, no response.\n2024-08-19: Asking again for a status update or meeting.\n2024-08-27: Scheduling a call for 2024-09-03\n2024-09-03: dormakaba technician provides status update about which vulnerabilities are already\n            fixed in the next release and on which they are still actively working on.\n2024-11-12: Asking for a status update and informing dormakaba that we tested a newer hardware\n            release of the dormakaba Access Manager (9200-K7) which is based on Linux.\n            Multiple new critical vulnerabilities were identified. A separate advisory\n            is in the making.\n2024-12-12: Meeting with dormakaba to discuss new identified issues in other hardware releases.\n2025-01-16: Added vulnerability \"Unauthenticated access to the internal SQLite Database\" \u0026\n            \"Static firmware encryption password\", see SEC Consult advisory 20260126-1.\n2025-01-17: Providing updated advisory to dormakaba, asking for a status update regarding\n            th"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:32:44Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/24"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://r.sec-consult.com/dormakaba"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.dormakaba.com/"
        },
        {
          "url": "https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions"
        },
        {
          "url": "https://www.dormakabagroup.com/en/security-advisories"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260126-2 :: UART Leaking Sensitive Data in dormakaba registration unit 9002 (PIN pad)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-59109",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0192",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/24",
            "automated": true,
            "contentSha256": "152b1c969b48c806c1bafb6a5fa4712c01bed7877aa0043ee74c1e276038462f",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-26T10:22:04Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0192"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T13:32:44Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0192"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}