Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Advisory: dormakaba Access Manager 92xx-k7 — dormakabagroup.com/en/security-advisories Clear all filters
TI-2025-36723 CVE-2025-59108 · GHSA-84q3-xpxq-862h

Weak Default Passwords in dormakaba access manager

Priority MEDIUM 42

By default, the password for the Access Manager's web interface, is set to 'admin'.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0045 Published 2026-01-26 No fix listed CWE-1392
TI-2025-36720 CVE-2025-59105 · GHSA-j955-p84j-6jrr

Unencrypted Flash Storage in dormakaba access manager

Priority LOW 32

With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption.

CVSS 4.0HIGH 7.0 Physical No auth No interaction EPSS 0.00109 Published 2026-01-26 No fix listed CWE-312
TI-2025-36719 CVE-2025-59104 · GHSA-82wq-479r-x8x9

Unlocked Bootloader in dormakaba access manager

Priority LOW 32

With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable).

CVSS 4.0HIGH 7.0 Physical No auth No interaction EPSS 0.00189 Published 2026-01-26 No fix listed CWE-1234
TI-2025-36716 CVE-2025-59101 · GHSA-fmc9-4f7f-vmq2

Insufficient Session Management in dormakaba access manager

Priority LOW 37

Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00752 Published 2026-01-26 No fix listed CWE-291