Dormakaba Access Manager 92xx-k5/Access Manager 92xx-k7 SOAP Interface TraceClient.exe trace information expsure

Summaryinfo

A vulnerability has been found in Dormakaba Access Manager 92xx-k5 and Access Manager 92xx-k7 and classified as problematic. Affected by this issue is the function trace of the file TraceClient.exe of the component SOAP Interface. Performing a manipulation results in information expsure. This vulnerability is cataloged as CVE-2025-59098. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Dormakaba Access Manager 92xx-k5 and Access Manager 92xx-k7 (the affected version unknown). This affects the function trace of the file TraceClient.exe of the component SOAP Interface. The manipulation with an unknown input leads to a information expsure vulnerability. CWE is classifying the issue as CWE-497. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. This is going to have an impact on confidentiality. The summary by CVE is:

The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the socket and receive debug information. The data is permanently broadcasted on the TCP socket. The socket can be accessed without any authentication or encryption. The transmitted data is based on the set verbosity level. The verbosity level can be set using the http(s) endpoint with the service interface password or with the guessable identifier of the device via the SOAP interface. The transmitted data contains sensitive data like the Card ID as well as all button presses on Registration units. This allows an attacker with network level access to retrieve all entered PINs on a registration unit.

The weakness was shared by Clemens Stockenreitner and Werner Schober. The advisory is shared at r.sec-consult.com. This vulnerability is uniquely identified as CVE-2025-59098 since 09/09/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Access Management Software

Vendor

• Dormakaba

Name

• Access Manager 92xx-k5
• Access Manager 92xx-k7

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion