Vulnerabilities

The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as well as documented in the locally stored user documentation.

The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets.

A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe).

Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server.

An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe.

Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005.

On the exos 9300 server, a SOAP API is reachable on port 8002.