Read the docs
TI-2025-36715 Aliases CVE-2025-59100GHSA-78gg-x59j-472c

Unauthenticated Access to the SQLite Database in dormakaba access manager

Priority LOW 28CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download is started and the device reboots. After rebooting, the exported database is deleted and cannot be accessed anymore. However, it was noticed that sometimes the device does not reboot and therefore the exported database is not deleted, or the device reboots and the export is not deleted for unknown reasons. The path where the database export is located can be accessed without prior authentication. This leads to the fact that an attacker might be able to get access to the exported database without prior authentication. The database includes sensitive data like passwords, card pins, encrypted Mifare sitekeys and much more.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00752 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dormakabaAccess Manager 92xx-k592xx-K5: <XAMB 04.06.212—No fix listedCNA
  • Access Manager 92xx-k5 Vendordormakaba Affected 92xx-K5: <XAMB 04.06.212 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    dormakaba Access Manager 92xx-k5 — dormakabagroup.com/en/security-advisories

    10 records Highest priority Priority MEDIUM 5 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2025-36712 Unauthenticated SOAP API in dormakaba access managerPriority MEDIUM 49
    • TI-2025-36718 Weak Default Passwords for SSH Access in dormakaba access managerPriority MEDIUM 48
    • TI-2025-36714 Unauthenticated Path Traversal in dormakaba access managerPriority MEDIUM 46
    Show all 10 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59100
  2. 2026-10-03 Alias added: GHSA-78gg-x59j-472c

References

Advisory 2

Other 1

  • TI-2024-38408 Dormakaba Saflok System 6000 Key Generation Cryptographic Weakness CVSS 4.0HIGH 8.7
  • TI-2025-36706 Hardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300 CVSS 4.0CRITICAL 9.3
  • TI-2025-36712 Unauthenticated SOAP API in dormakaba access manager CVSS 4.0CRITICAL 9.3
  • TI-2025-36718 Weak Default Passwords for SSH Access in dormakaba access manager CVSS 4.0CRITICAL 9.2
  • TI-2025-36705 Unauthenticated SOAP API in dormakaba Kaba exos 9300 CVSS 4.0CRITICAL 9.3
  • TI-2025-36714 Unauthenticated Path Traversal in dormakaba access manager CVSS 4.0HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences