{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260126-2",
          "vendor": "Dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260126-2 \u003e\n=======================================================================\n              title: UART Leaking Sensitive Data\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: dormakaba registration unit 9002 (PIN pad)\n vulnerable version: \u003cSW0039\n\u00a0 \u00a0 \u00a0 fixed version: SW0039\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-59109\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: medium\n           homepage:https://www.dormakaba.com/\n              found: 2024-03-18\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0by: Clemens Stockenreitner (Office Vienna)\n                     Werner Schober (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The Kaba exos 9300 basic system is the cornerstone of your access\nmanagement solution. Use it to resolves all your basic employees,\nsystem, user and peripheral management tasks and initiate targeted\nsecurity measures as required. [...] \"\n\nSource:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides an updated hardware revision of the device.\nMore details can be found at the following locations:\n- Solution at the end of this advisory\n- SEC Consult blog post:https://r.sec-consult.com/dormakaba\n- Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories\n- Your dormakaba partner\n\n\nTested Architecture Overview\n-----------------------------------\nThe tested system is the enterprise grade physical access system from\ndormakaba. The tested system consists of the following components:\n\n------------------------------\ndormakaba exos 9300\n------------------------------\nExos 9300 is a piece of software based on C# running on a central Windows server with\nan MSSQL, or Oracle database as central storage.\nExos consists of multiple modules (e.g. basis, employee management, key depot, access,\nvisitor management, 3rd party management). Exos is used to centrally manage users,\nkeys, cards as well as the configuration of the access manager. Devices in the\nexos environment are addressed using a special addressing scheme. The address scheme\ndescribed in the following table is going to be important.\n\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502         I          \u2502            01             \u2502      00       \u2502                    01                     \u2502          \n  00             \u2502        00         \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 Port Type          \u2502 Communication Hub Address \u2502 Port Address  \u2502 Access Hub Address                        \u2502 00 = \nDoor Manager         \u2502 Datapoint Address \u2502\n\u2502 I = Access Manager \u2502 Values: 01-99             \u2502 Values: 00-99 \u2502 Values: 00-99                             \u2502 01 = \nAccess Point         \u2502 Values: 00-20     \u2502\n\u2502 B = Serial         \u2502                           \u2502               \u2502 Fixed to 01 for Access Hubs with Ethernet \u2502 02 = \nTurnstile            \u2502                   \u2502\n\u2502 C = Modem          \u2502                           \u2502               \u2502                                           \u2502 03 = IO \nController        \u2502                   \u2502\n\u2502 E = Ethernet       \u2502                           \u2502               \u2502                                           \u2502 Fixed to \n00 in most cases \u2502                   \u2502\n\u2502 R = remote         \u2502                           \u2502               \u2502                                           \u2502          \n                 \u2502                   \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n------------------------------\ndormakaba Access Manager\n------------------------------\nThe access manager is a component that is configured via exos. The configuration\nbetween exos and access manager is exchanged via a SOAP interface. Per default\nthe data exchange is unencrypted. Encryption is only available starting with\naccess manager hardware release K7.\nThe access manager is a custom piece of hardware with multiple inputs and outputs.\nThe device offers the following interfaces:\n- Digital Inputs\n- 3x DC Output Relays\n- 2x RS-232\n- 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125)\n- 1x RJ45\n- 1x Micro USB\n- 2x Coax (Used to connect registration units e.g. 9001, 9002)\n\nThe tested hardware was an access manager 9200-k5 running Windows CE embedded,\nand an access manager 9200-k7 running Linux.\n\n------------------------------\ndormakaba Registration Unit\n------------------------------\nDormakaba registration units can be either a Legic/Mifare card reader,\nor a PIN pad used to enter a PIN to deactivate alarming systems, or as\nan additional authentication.\n\n------------------------------\nElectric lock\n------------------------------\nThe lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock\nis simply controlled via a relay contact connected to the access manager. As\nsoon as a user successfully authenticates with a registration unit,\nthe relay connected to the lock is switched and the door opens.\n\nThe system is depicted in the following diagram.\n\n          \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502\n          \u2502exos 9300\u2502              \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n          \u2502         \u2502              \u2502 Reg Unit \u2502  \u2502 Pin Pad  \u2502\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518              \u2502   \u250c\u2500\u2500\u2510   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   \u2502\u253c\u253c\u2502   \u2502  \u2502  x x x   \u2502\nEthernet\u2500\u2500\u2500\u2500\u2500\u2500\u25ba\u2502                   \u2502   \u2514\u2500\u2500\u2518   \u2502  \u2502  x x x   \u2502\n               \u2502                   \u2502   9001   \u2502  \u2502   9002   \u2502\n          \u250c\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2510              \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518  \u2514\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518\n          \u2502 Access  \u2502                    \u2502             \u2502\n          \u2502 Manager \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n          \u2502  9200   \u2502        \u25b2\n          \u2514\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2518        \u2502\n               \u2502           Coax\n               \u2502\n  DC Relay\u2500\u2500\u2500\u25ba \u2502\n               \u2502\n            \u250c\u2500\u2500\u2534\u2500\u2500\u2510\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2502    \u2500\u2524\u25c4\u2500\u2500\u2500\u2500\u2500\u2500Electric Lock\n            \u2502     \u2502\n            \u2502     \u2502\n            \u2514\u2500\u2500\u2500\u2500\u2500\u2518\n\n\n\nVulnerability overview/description:\n-----------------------------------\n1) UART Leaking Sensitive Data (CVE-2025-59109)\nThe dormakaba registration units 9002 (PIN Pad Units) have an exposed UART\nheader on the backside. The PIN pad is sending every button press to the UART\ninterface. An attacker can use the interface to exfiltrate PINs. As the\ndevices are explicitly built as Plug-and-Play to be easily replaced, an attacker\nis easily able to remove the device, install a hardware implant which connects\nto the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).\n\n\nProof of concept:\n-----------------\n1) UART Leaking Sensitive Data (CVE-2025-59109)\nTo verify that the UART interface actually sends the entered numbers, wires have been\nsoldered to the board of the keypad. Using a baud rate of 57.600, one stop bit and no\nparity bits, the data keystrokes can be received.\n\nThe received output then includes the pressed keys, and the coordinates of the pressed\nkey in the following format.\n\n1,1324,0395,\n5,1294,0386,\n8,1290,0398,\n6,1294,0388,\n6,1294,0403,\nE,1304,0374,\n\n\nVulnerable / tested versions:\n-----------------------------\nAll hardware revisions with a firmware version \u003cSW0039, which was the latest\nversion available at the time of the test, are vulnerable.\n\n\nVendor contact timeline:\n------------------------\n2024-04-02: Contacting vendor throughsecuritysupport () dormakaba com, no response\n2024-04-05: Contacting vendor again throughsecuritysupport () dormakaba com, no response\n2024-04-09: Contacting vendor again throughinfo () dormakaba com andhelpdesk.awm.ch () dormakaba com\n2024-04-09:info () dormakaba com andhelpdesk.awm.ch () dormakaba com informed us\n            that they are not responsible for Austrian \"Customers\" and we should\n            contact the Austrian dormakaba entity.\n2024-04-09: Contacting vendor again throughinfo () dormakaba com,helpdesk.awm.ch () dormakaba com\n            andsecuritysupport () dormakaba com. Explaining that this is not a local\n            Austrian problem, but a global issue for dormakaba. Requesting a Global\n            Security Contact.\n2024-04-09: Instead of forwarding our message to the global security team a local\n            Austrian dormakaba representative called us. We closed the call down by\n            requesting a contact of dormakaba\u0027s global security team.\n2024-04-09: Austrian representatives requests the advisory via E-Mail. Asking for\n            confirmation, if mail encryption is supported or if the advisory\n            shall be forwarded unencrypted.\n2024-04-10: Scheduling a conference call with the Austrian contact to clarify everything\n            and explain the security issues.\n2024-04-10: Conference call got cancelled. The Austrian contact forwarded our request to\n            the headquarter in Switzerland.\n2024-04-10: dormakaba\u0027s CISO contacted us via email and informed us to get back to us\n            as soon as possible.\n2024-04-12: dormakaba\u0027s DVP Systems Access Control und Owner Security Governance contacted\n            us via email and provided us with a secure channel to submit the advisory. The\n            advisory got submitted immediately.\n2024-04-12: dormakaba\u0027s DVP Systems Access Control und Owner Security Governance requests\n            details about the tested firmware and software version.\n2024-04-15: SEC Consult provides detailed software and firmware version that was tested.\n2024-04-16: dormakaba updates us and informs us that they are actively investigating\n            the reported issues.\n2024-04-30: Asking for a status update \u0026 offering a meeting to discuss any questions.\n2024-04-30: dormakaba\u0027s CISO replies by accepting our meeting offer. Scheduling a meeting\n            for 2024-05-07.\n2024-05-07: Meeting with dormakaba\u0027s CISO and DVP Systems Access Control. All vulnerabilities\n            are confirmed and actively worked on. Discussing further steps and agreeing on a\n            monthly update meeting with dormakaba.\n2024-05-08: Providing further details concerning the vulnerabilities as well as\n            providing a set of questions (Vulnerable Versions, Firmware, Revisions), proposing\n            meeting dates; no response\n2024-05-23: Asking for a status update, no response\n2024-06-03: Asking again for a status update.\n2024-06-04: dormakaba\u0027s CISO replies with a meeting invite.\n2024-06-05: Meeting with dormakaba for the scheduled monthly update meeting.\n2024-07-24: Asking again for a status update, no response.\n2024-07-31: Asking again for a status update or meeting, no response.\n2024-08-19: Asking again for a status update or meeting.\n2024-08-27: Scheduling a call for 2024-09-03\n2024-09-03: dormakaba technician provides status update about which vulnerabilities are already\n            fixed in the next release and on which they are still actively working on.\n2024-11-12: Asking for a status update and informing dormakaba that we tested a newer hardware\n            release of the dormakaba Access Manager (9200-K7) which is based on Linux.\n            Multiple new critical vulnerabilities were identified. A separate advisory\n            is in the making.\n2024-12-12: Meeting with dormakaba to discuss new identified issues in other hardware releases.\n2025-01-16: Added vulnerability \"Unauthenticated access to the internal SQLite Database\" \u0026\n            \"Static firmware encryption password\", see SEC Consult advisory 20260126-1.\n2025-01-17: Providing updated advisory to dormakaba, asking for a status update regarding\n            th"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:32:44Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/24"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://r.sec-consult.com/dormakaba"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.dormakaba.com/"
        },
        {
          "url": "https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions"
        },
        {
          "url": "https://www.dormakabagroup.com/en/security-advisories"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260126-2 :: UART Leaking Sensitive Data in dormakaba registration unit 9002 (PIN pad)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-59109",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0192",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/24",
            "automated": true,
            "contentSha256": "152b1c969b48c806c1bafb6a5fa4712c01bed7877aa0043ee74c1e276038462f",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-26T10:22:04Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0192"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T13:32:44Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0192"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}