CVE-2025-59108criticalCWE-1392

CVE-2025-59108: falha crítica em dormakaba Access Manager 92xx-k5

Weak Default Passwords in dormakaba access manager

Publicada em

Seguir esta CVE+ Monitorar Access Manager 92xx-k5+ Monitorar Access Manager 92xx-k7

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.4%
By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
dormakaba · Access Manager 92xx-k5dormakaba · Access Manager 92xx-k7
CVEs relacionadas — dormakaba Access Manager 92xx-k5

No mesmo produto, das mais perigosas para as menos.

CVE-2025-59099HIGHUnauthenticated Path Traversal in dormakaba access managerEPSS 0.9%CVE-2025-59106HIGHWeb Server Running with Root Privileges in dormakaba access managerEPSS 0.8%CVE-2025-59101HIGHInsufficient Session Management in dormakaba access managerEPSS 0.8%CVE-2025-59100MEDIUMUnauthenticated Access to the SQLite Database in dormakaba access managerEPSS 0.8%CVE-2025-59097CRITICALUnauthenticated SOAP API in dormakaba access managerEPSS 0.7%CVE-2025-59103CRITICALWeak Default Passwords for SSH Access in dormakaba access managerEPSS 0.4%