Dormakaba vulnerabilities
We track 15 vulnerabilities in Dormakaba products across 4 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on January 26, 2026.
Latest Dormakaba vulnerabilities
- 8.5 High severity
Access Manager 92xx-k5: Use of Hard-coded Credentials
Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the fir
- 8.8 High severity
Access Manager 92xx-k7: Least Privilege Violation
The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is
- 7.0 High severity
Access Manager 92xx-k5: Cleartext Storage of Sensitive Information
With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, store
- 7.0 High severity
Access Manager 92xx-k7: Hardware Internal or Debug Modes Allow Override of Locks
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacke
- 9.2 Critical severity
Access Manager 92xx-k5: Use of Weak Credentials
The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the devices, it w
- 7.7 High severity
Access Manager 92xx-k5: Reliance on IP Address for Authentication
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authent
- 8.8 High severity
Access Manager 92xx-k5: Path Traversal: '.../...//'
The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. Hence,
- 8.7 High severity
Access Manager 92xx-k5: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used t
- 9.3 Critical severity
Access Manager 92xx-k5: Missing Authentication for Critical Functionality
The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is
- 8.4 High severity
Kaba exos 9300: Improper Privilege Management
A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specifi
- 8.5 High severity
Kaba exos 9300: Reliance on Security Through Obscurity
Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from th
- 8.7 High severity
Kaba exos 9300: Use of Hard-coded Credentials
An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used for interprocess communication between services and the Kaba exos 9300 GUI, containing status information about the Acces
- 9.3 Critical severity
Kaba exos 9300: Use of Hard-coded Credentials
Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among othe
- 9.3 Critical severity
Kaba exos 9300: Missing Authentication for Critical Functionality
On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the
- 9.8 Critical severity
Dormakaba Saflok System 6000: Improper Finite State Machines (FSMs) in Hardware Logic
Dormakaba Saflok System 6000 contains a predictable key generation algorithm that allows attackers to derive card access keys from a 32-bit unique identifier. Attackers can exploit the deterministic key generation process by calculating valid access keys using