CVE-2025-59093: falha de alta gravidade em dormakaba Kaba exos 9300
Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 9300
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.2%
Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from the registry. This allows an attacker to derive the database password and get authenticated access to the central exos 9300 database as the user Exos9300Common. The user has the roles ExosDialog and ExosDialogDotNet assigned, which are able to read most tables of the database as well as update and insert into many tables.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
dormakaba · Kaba exos 9300CVEs relacionadas — dormakaba Kaba exos 9300
No mesmo produto, das mais perigosas para as menos.
CVE-2025-59090CRITICALUnauthenticated SOAP API in dormakaba Kaba exos 9300EPSS 1.2%CVE-2025-59092HIGHUnauthenticated RPC Service in dormakaba Kaba exos 9300EPSS 0.9%CVE-2025-59091CRITICALHardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300EPSS 0.9%CVE-2025-59096MEDIUMWeak Default Password in dormakaba Kaba exos 9300EPSS 0.2%CVE-2025-59094HIGHLocal Privilege Escalation in dormakaba Kaba exos 9300 System managementEPSS 0.2%CVE-2025-59095MEDIUMHard-coded Key for PIN Encryption in dormakaba Kaba exos 9300EPSS 0.1%