CVE-2025-59090 in Kaba exos 9300
Summary
by MITRE • 01/26/2026
On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/26/2026
The vulnerability described in CVE-2025-59090 represents a critical authentication bypass flaw within the Exos 9300 server's SOAP API implementation. This server, designed for enterprise storage and management solutions, exposes a communication endpoint on port 8002 that serves the Simple Object Access Protocol interface without requiring any form of authentication. The absence of authentication mechanisms creates an open attack surface that allows any network entity with access to the server to interact with the SOAP API directly. This fundamental flaw violates core security principles of access control and privilege management, as the API operates in a completely unauthenticated state.
The technical implications of this vulnerability extend beyond simple unauthorized access, as the exposed SOAP API provides access to sensitive operational functions within the Exos 9300 system. Attackers can leverage this vulnerability to generate arbitrary access log events, which can be used for various malicious purposes including denial of service attacks, data manipulation, or creating false audit trails that obscure actual security incidents. Additionally, the API allows for querying two-factor authentication PINs associated with enrolled chip cards, which represents a severe compromise of the system's multi-factor authentication security model. This capability directly undermines the security posture by potentially exposing authentication credentials that should remain protected and private.
From an operational impact perspective, this vulnerability creates significant risk for organizations relying on Exos 9300 servers for storage management and security operations. The ability to manipulate access logs without authentication can lead to sophisticated attack concealment techniques, making it difficult for security teams to detect and respond to actual security incidents. The exposure of 2FA PINs associated with chip cards represents a complete breakdown of the layered security approach that organizations typically implement. According to CWE-306, this vulnerability maps directly to improper authorization issues where authentication mechanisms are missing or improperly implemented. The ATT&CK framework categorizes this as a privilege escalation and credential access technique, as adversaries can leverage the exposed API to obtain sensitive information and potentially gain further system access.
Organizations should implement immediate mitigations including network segmentation to restrict access to port 8002, deploying firewall rules to limit access to authorized IP addresses only, and implementing network monitoring to detect unusual patterns in SOAP API access. The most effective long-term solution involves implementing proper authentication mechanisms for the SOAP API, potentially through token-based authentication, certificate-based authentication, or integration with existing enterprise authentication systems. Additionally, organizations should conduct comprehensive security audits of all exposed APIs and services, ensuring that any communication endpoints are properly secured with appropriate access controls. The vulnerability highlights the critical importance of principle of least privilege implementation and demonstrates how seemingly minor configuration oversights can create significant security risks that may affect entire enterprise infrastructure.