CVE-2025-59106: falha de alta gravidade em dormakaba Access Manager 92xx-k7
Web Server Running with Root Privileges in dormakaba access manager
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.8%
The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
dormakaba · Access Manager 92xx-k7CVEs relacionadas — dormakaba Access Manager 92xx-k7
No mesmo produto, das mais perigosas para as menos.
CVE-2025-59099HIGHUnauthenticated Path Traversal in dormakaba access managerEPSS 0.9%CVE-2025-59101HIGHInsufficient Session Management in dormakaba access managerEPSS 0.8%CVE-2025-59097CRITICALUnauthenticated SOAP API in dormakaba access managerEPSS 0.7%CVE-2025-59108CRITICALWeak Default Passwords in dormakaba access managerEPSS 0.4%CVE-2025-59098HIGHTrace Functionality Leaking Sensitive Data in dormakaba access managerEPSS 0.4%CVE-2025-59104HIGHUnlocked Bootloader in dormakaba access managerEPSS 0.2%