Access Manager 92xx-k7 vulnerabilities
7 known vulnerabilities in Access Manager 92xx-k7 from Dormakaba. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Access Manager 92xx-k7: Least Privilege Violation
The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is
- 7.0 High severity
Access Manager 92xx-k5: Cleartext Storage of Sensitive Information
With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, store
- 7.0 High severity
Access Manager 92xx-k7: Hardware Internal or Debug Modes Allow Override of Locks
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacke
- 7.7 High severity
Access Manager 92xx-k5: Reliance on IP Address for Authentication
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authent
- 8.8 High severity
Access Manager 92xx-k5: Path Traversal: '.../...//'
The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. Hence,
- 8.7 High severity
Access Manager 92xx-k5: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used t
- 9.3 Critical severity
Access Manager 92xx-k5: Missing Authentication for Critical Functionality
The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is