CVE-2025-59107: high-severity vulnerability in dormakaba Access Manager 92xx-k5
Static Firmware Encryption Password in dormakaba access manager
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 0.2%
Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the firmware is set statically and can be extracted. This password was valid for multiple observed firmware versions.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
dormakaba · Access Manager 92xx-k5Related CVEs — dormakaba Access Manager 92xx-k5
In the same product, most dangerous first.
CVE-2025-59099HIGHUnauthenticated Path Traversal in dormakaba access managerEPSS 0.9%CVE-2025-59101HIGHInsufficient Session Management in dormakaba access managerEPSS 0.8%CVE-2025-59100MEDIUMUnauthenticated Access to the SQLite Database in dormakaba access managerEPSS 0.8%CVE-2025-59097CRITICALUnauthenticated SOAP API in dormakaba access managerEPSS 0.7%CVE-2025-59108CRITICALWeak Default Passwords in dormakaba access managerEPSS 0.4%CVE-2025-59103CRITICALWeak Default Passwords for SSH Access in dormakaba access managerEPSS 0.4%