CVE-2025-59091

Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically visualize open doors and alerts. However, controlling the Access Managers via this interface is also possible. To send and receive status information, authentication is necessary. The Kaba exos 9300 application contains hard-coded credentials for four different users, which are allowed to login to the datapoint server and receive as well as send information, including commands to open arbitrary doors.

CVSS

No CVSS.

References

Link	Resource
https://r.sec-consult.com/dkexos
https://r.sec-consult.com/dormakaba
https://www.dormakabagroup.com/en/security-advisories

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Múltiples credenciales codificadas han sido identificadas, a las que se les permite iniciar sesión en el servidor de puntos de datos exos 9300 que se ejecuta en el puerto 1004 y 1005. Este servidor se utiliza para retransmitir información de estado desde y hacia los Gestores de Acceso. Esta información, entre otras cosas, se utiliza para visualizar gráficamente puertas abiertas y alertas. Sin embargo, controlar los Gestores de Acceso a través de esta interfaz también es posible. Para enviar y recibir información de estado, la autenticación es necesaria. La aplicación Kaba exos 9300 contiene credenciales codificadas para cuatro usuarios diferentes, a los que se les permite iniciar sesión en el servidor de puntos de datos y recibir, así como enviar, información, incluyendo comandos para abrir puertas arbitrarias.

26 Jan 2026, 10:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-26 10:16

Updated : 2026-04-15 00:35

NVD link : CVE-2025-59091

Mitre link : CVE-2025-59091

CVE.ORG link : CVE-2025-59091

JSON object : View

Products Affected

No product.

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2025-59091", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-26T10:16:06.450", "references": [{"url": "https://r.sec-consult.com/dkexos", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://r.sec-consult.com/dormakaba", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://www.dormakabagroup.com/en/security-advisories", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically visualize open doors and alerts. However, controlling the Access Managers via this interface is also possible.\n\nTo send and receive status information, authentication is necessary. The Kaba exos 9300 application contains hard-coded credentials for four different users, which are allowed to login to the datapoint server and receive as well as send information, including commands to open arbitrary doors."}, {"lang": "es", "value": "M\u00faltiples credenciales codificadas han sido identificadas, a las que se les permite iniciar sesi\u00f3n en el servidor de puntos de datos exos 9300 que se ejecuta en el puerto 1004 y 1005. Este servidor se utiliza para retransmitir informaci\u00f3n de estado desde y hacia los Gestores de Acceso. Esta informaci\u00f3n, entre otras cosas, se utiliza para visualizar gr\u00e1ficamente puertas abiertas y alertas. Sin embargo, controlar los Gestores de Acceso a trav\u00e9s de esta interfaz tambi\u00e9n es posible.\n\nPara enviar y recibir informaci\u00f3n de estado, la autenticaci\u00f3n es necesaria. La aplicaci\u00f3n Kaba exos 9300 contiene credenciales codificadas para cuatro usuarios diferentes, a los que se les permite iniciar sesi\u00f3n en el servidor de puntos de datos y recibir, as\u00ed como enviar, informaci\u00f3n, incluyendo comandos para abrir puertas arbitrarias."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}