Dormakaba Kaba exos 9300 up to 4.3.2 Kaba.EXOS.common.dll EncryptAndDecrypt hard-coded credentials

Summaryinfo

A vulnerability identified as critical has been detected in Dormakaba Kaba exos 9300 up to 4.3.2. The impacted element is the function EncryptAndDecrypt in the library Kaba.EXOS.common.dll. Performing a manipulation results in hard-coded credentials. This vulnerability is known as CVE-2025-59095. Attacking locally is a requirement. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Dormakaba Kaba exos 9300 up to 4.3.2. This affects the function EncryptAndDecrypt in the library Kaba.EXOS.common.dll. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality. The summary by CVE is:

The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption technique combined with a cryptographic key (cryptoKey) to transform each character of the input string. However, it's important to note that this implementation does not provide strong encryption and should not be considered secure for sensitive data. It's more of a custom encryption approach rather than a common algorithm used in cryptographic applications. The key itself is static and based on the founder's name of the company. The functionality is for example used to encrypt the user PINs before storing them in the MSSQL database.

The weakness was published by Clemens Stockenreitner and Werner Schober. It is possible to read the advisory at r.sec-consult.com. This vulnerability is uniquely identified as CVE-2025-59095 since 09/09/2025. The exploitability is told to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

Upgrading to version 4.3.3 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Dormakaba

Name

• Kaba exos 9300

Version

• 4.3.0
• 4.3.1
• 4.3.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion