Vulnerabilities

The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside.

By default, the password for the Access Manager's web interface, is set to 'admin'.

Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network.

With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption.

With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable).

The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions.

The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device.

Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in.

The web interface offers a functionality to export the internal SQLite database.

The Access Manager is using the open source web server CompactWebServer written in C#.

The Access Manager is offering a trace functionality to debug errors and issues with the device.

The exos 9300 application can be used to configure Access Managers (e.g.

The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as well as documented in the locally stored user documentation.

The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets.

A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe).

Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server.

An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe.

Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005.

On the exos 9300 server, a SOAP API is reachable on port 8002.

Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit unique identifier.