Vulnerabilities

TI-2025-36723 CVE-2025-59108 · GHSA-84q3-xpxq-862h

Weak Default Passwords in dormakaba access manager

MEDIUM 42

By default, the password for the Access Manager's web interface, is set to 'admin'.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0045 Published 2026-01-26 No fix listed CWE-1392

TI-2025-36722 CVE-2025-59107 · GHSA-jf3f-jhfm-f446

Static Firmware Encryption Password in dormakaba access manager

LOW 36

Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network.

CVSS 4.0HIGH 8.5 Local No auth No interaction EPSS 0.00177 Published 2026-01-26 No fix listed CWE-798

TI-2025-36720 CVE-2025-59105 · GHSA-j955-p84j-6jrr

Unencrypted Flash Storage in dormakaba access manager

LOW 32

With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption.

CVSS 4.0HIGH 7.0 Physical No auth No interaction EPSS 0.00109 Published 2026-01-26 No fix listed CWE-312

TI-2025-36718 CVE-2025-59103 · GHSA-cm8m-44xc-f932

Weak Default Passwords for SSH Access in dormakaba access manager

MEDIUM 48

The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0043 Published 2026-01-26 No fix listed CWE-1391

TI-2025-36717 CVE-2025-59102 · GHSA-8fr2-7cfw-phcg

Secrets Stored in Plaintext in Database in dormakaba access manager

LOW 37

The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00373 Published 2026-01-26 No fix listed CWE-312

TI-2025-36716 CVE-2025-59101 · GHSA-fmc9-4f7f-vmq2

Insufficient Session Management in dormakaba access manager

LOW 37

Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00752 Published 2026-01-26 No fix listed CWE-291

TI-2025-36715 CVE-2025-59100 · GHSA-78gg-x59j-472c

Unauthenticated Access to the SQLite Database in dormakaba access manager

LOW 28

The web interface offers a functionality to export the internal SQLite database.

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.00752 Published 2026-01-26 No fix listed CWE-285

TI-2025-36714 CVE-2025-59099 · GHSA-2r8v-44qx-992x

Unauthenticated Path Traversal in dormakaba access manager

MEDIUM 46

The Access Manager is using the open source web server CompactWebServer written in C#.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00869 Published 2026-01-26 No fix listed CWE-35

TI-2025-36713 CVE-2025-59098 · GHSA-p5p6-g8q2-vx84

Trace Functionality Leaking Sensitive Data in dormakaba access manager

MEDIUM 44

The Access Manager is offering a trace functionality to debug errors and issues with the device.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00405 Published 2026-01-26 No fix listed CWE-497

TI-2025-36712 CVE-2025-59097 · GHSA-58xh-r44m-24vv

Unauthenticated SOAP API in dormakaba access manager

MEDIUM 49

The exos 9300 application can be used to configure Access Managers (e.g.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0065 Published 2026-01-26 No fix listed CWE-1188

Vulnerabilities

Filters