Unauthenticated SOAP API in dormakaba Kaba exos 9300

The dormakaba Kaba exos 9300 server exposes a SOAP API without requiring a login, allowing anyone with network access to create fake access logs and steal two-factor authentication PINs from chip cards. This completely bypasses security controls meant to protect physical access systems.

An unauthenticated SOAP API is exposed on port 8002 of the exos 9300 server, enabling network-adjacent attackers to perform unauthorized actions including arbitrary access log event creation and retrieval of 2FA PINs associated with enrolled chip cards. Authentication controls are missing (CWE-306), allowing direct manipulation of security-critical functions and compromise of multi-factor authentication mechanisms.