Read the docs
TI-2025-36712 Aliases CVE-2025-59097GHSA-58xh-r44m-24vv

Unauthenticated SOAP API in dormakaba access manager

Priority MEDIUM 49CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is sent to the selected Access Manager via SOAP. The SOAP request is sent without any prior authentication or authorization by default. Though authentication and authorization can be configured using IPsec for 92xx-K5 devices and mTLS for 92xx-K7 devices, it is not enabled by default and must therefore be activated with additional steps. This insecure default allows an attacker with network level access to completely control the whole environment. An attacker is for example easily able to conduct the following tasks without prior authentication: - Re-configure Access Managers (e.g. remove alarming system requirements) - Freely re-configure the inputs and outputs - Open all connected doors permanently - Open all doors for a defined time interval - Change the admin password - and many more Network level access can be gained due to an insufficient network segmentation as well as missing LAN firewalls. Devices with an insecure configuration have been identified to be directly exposed to the internet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0065 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dormakabaAccess Manager 92xx-k592xx-K5: All Versions and later—No fix listedCNA
dormakabaAccess Manager 92xx-k792xx-K7: Older than BAME 06.00 must be configured—No fix listedCNA
  • Access Manager 92xx-k5 Vendordormakaba Affected 92xx-K5: All Versions and later Fixed in — No fix listed CNA
  • Access Manager 92xx-k7 Vendordormakaba Affected 92xx-K7: Older than BAME 06.00 must be configured Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    dormakaba Access Manager 92xx-k5, Access Manager 92xx-k7 — dormakabagroup.com/en/security-advisories

    12 records Highest priority Priority MEDIUM 6 MEDIUM, 6 LOW

    Other records, highest priority first

    • TI-2025-36718 Weak Default Passwords for SSH Access in dormakaba access managerPriority MEDIUM 48
    • TI-2025-36714 Unauthenticated Path Traversal in dormakaba access managerPriority MEDIUM 46
    • TI-2025-36713 Trace Functionality Leaking Sensitive Data in dormakaba access managerPriority MEDIUM 44
    Show all 12 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59097
  2. 2026-10-03 Alias added: GHSA-58xh-r44m-24vv
  3. 2026-10-09 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 1

  • TI-2024-38408 Dormakaba Saflok System 6000 Key Generation Cryptographic Weakness CVSS 4.0HIGH 8.7
  • TI-2025-36706 Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300 CVSS 4.0CRITICAL 9.3
  • TI-2025-36718 Weak Default Passwords for SSH Access in dormakaba access manager CVSS 4.0CRITICAL 9.2
  • TI-2025-36705 Unauthenticated SOAP API in dormakaba Kaba exos 9300 CVSS 4.0CRITICAL 9.3
  • TI-2025-36714 Unauthenticated Path Traversal in dormakaba access manager CVSS 4.0HIGH 8.8
  • TI-2025-36707 Unauthenticated RPC Service in dormakaba Kaba exos 9300 CVSS 4.0HIGH 8.7
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences