Dormakaba Access Manager 92xx-k5/Access Manager 92xx-k7 Graphical User Interface missing authentication

Summaryinfo

A vulnerability labeled as critical has been found in Dormakaba Access Manager 92xx-k5 and Access Manager 92xx-k7. This affects an unknown function of the component Graphical User Interface. Executing a manipulation can lead to missing authentication. This vulnerability is handled as CVE-2025-59097. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as very critical was found in Dormakaba Access Manager 92xx-k5 and Access Manager 92xx-k7 (the affected version unknown). This vulnerability affects an unknown part of the component Graphical User Interface. The manipulation with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is sent to the selected Access Manager via SOAP. The SOAP request is sent without any prior authentication or authorization by default. Though authentication and authorization can be configured using IPsec for 92xx-K5 devices and mTLS for 92xx-K7 devices, it is not enabled by default and must therefore be activated with additional steps. This insecure default allows an attacker with network level access to completely control the whole environment. An attacker is for example easily able to conduct the following tasks without prior authentication: - Re-configure Access Managers (e.g. remove alarming system requirements) - Freely re-configure the inputs and outputs - Open all connected doors permanently - Open all doors for a defined time interval - Change the admin password - and many more Network level access can be gained due to an insufficient network segmentation as well as missing LAN firewalls. Devices with an insecure configuration have been identified to be directly exposed to the internet.

The weakness was released by Clemens Stockenreitner and Werner Schober. The advisory is shared for download at r.sec-consult.com. This vulnerability was named CVE-2025-59097 since 09/09/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/26/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Access Management Software

Vendor

• Dormakaba

Name

• Access Manager 92xx-k5
• Access Manager 92xx-k7

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion