CVE-2025-59107: falha de alta gravidade em dormakaba Access Manager 92xx-k5
Static Firmware Encryption Password in dormakaba access manager
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.2%
Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the firmware is set statically and can be extracted. This password was valid for multiple observed firmware versions.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
dormakaba · Access Manager 92xx-k5CVEs relacionadas — dormakaba Access Manager 92xx-k5
No mesmo produto, das mais perigosas para as menos.
CVE-2025-59099HIGHUnauthenticated Path Traversal in dormakaba access managerEPSS 0.9%CVE-2025-59101HIGHInsufficient Session Management in dormakaba access managerEPSS 0.8%CVE-2025-59100MEDIUMUnauthenticated Access to the SQLite Database in dormakaba access managerEPSS 0.8%CVE-2025-59097CRITICALUnauthenticated SOAP API in dormakaba access managerEPSS 0.7%CVE-2025-59108CRITICALWeak Default Passwords in dormakaba access managerEPSS 0.4%CVE-2025-59103CRITICALWeak Default Passwords for SSH Access in dormakaba access managerEPSS 0.4%