CVE-2025-59104: falha de alta gravidade em dormakaba Access Manager 92xx-k7
Unlocked Bootloader in dormakaba access manager
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7epss 0.2%
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through this vulnerability.
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
dormakaba · Access Manager 92xx-k7CVEs relacionadas — dormakaba Access Manager 92xx-k7
No mesmo produto, das mais perigosas para as menos.
CVE-2025-59099HIGHUnauthenticated Path Traversal in dormakaba access managerEPSS 0.9%CVE-2025-59106HIGHWeb Server Running with Root Privileges in dormakaba access managerEPSS 0.8%CVE-2025-59101HIGHInsufficient Session Management in dormakaba access managerEPSS 0.8%CVE-2025-59097CRITICALUnauthenticated SOAP API in dormakaba access managerEPSS 0.7%CVE-2025-59108CRITICALWeak Default Passwords in dormakaba access managerEPSS 0.4%CVE-2025-59098HIGHTrace Functionality Leaking Sensitive Data in dormakaba access managerEPSS 0.4%