CVE-2025-59101: falha de alta gravidade em dormakaba Access Manager 92xx-k5
Insufficient Session Management in dormakaba access manager
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.8%
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVEs relacionadas — dormakaba Access Manager 92xx-k5
No mesmo produto, das mais perigosas para as menos.
CVE-2025-59099HIGHUnauthenticated Path Traversal in dormakaba access managerEPSS 0.9%CVE-2025-59106HIGHWeb Server Running with Root Privileges in dormakaba access managerEPSS 0.8%CVE-2025-59100MEDIUMUnauthenticated Access to the SQLite Database in dormakaba access managerEPSS 0.8%CVE-2025-59097CRITICALUnauthenticated SOAP API in dormakaba access managerEPSS 0.7%CVE-2025-59108CRITICALWeak Default Passwords in dormakaba access managerEPSS 0.4%CVE-2025-59103CRITICALWeak Default Passwords for SSH Access in dormakaba access managerEPSS 0.4%