{"id":"CVE-2025-59090","state":"PUBLISHED","title":"Unauthenticated SOAP API in dormakaba Kaba exos 9300","description":"On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.","publishedAt":"2026-01-26T10:03:21.868Z","updatedAt":"2026-01-26T15:38:17.362Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","source":"SEC-VLab"},"assigner":"SEC-VLab","products":["dormakaba Kaba exos 9300"],"affected":[{"vendor":"dormakaba","product":"Kaba exos 9300","defaultStatus":"unknown","versions":[{"version":"<4.4.0 manual mitigation needed","status":"affected"},{"version":">=4.4.0 with 92xx-K7 secured by default","status":"unaffected"}]}],"references":["https://r.sec-consult.com/dormakaba","https://r.sec-consult.com/dkexos","https://www.dormakabagroup.com/en/security-advisories"],"weaknesses":["CWE-306","CWE-1188"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/59xxx/CVE-2025-59090.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-59090","state":"PUBLISHED","datePublished":"2026-01-26T10:03:21.868Z","dateUpdated":"2026-01-26T15:38:17.362Z","assignerShortName":"SEC-VLab","assignerOrgId":"551230f0-3615-47bd-b7cc-93e92e730bbf","dateReserved":"2025-09-09T07:52:56.382Z"},"containers":{"cna":{"title":"Unauthenticated SOAP API in dormakaba Kaba exos 9300","descriptions":[{"lang":"en","value":"On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards."}],"affected":[{"vendor":"dormakaba","product":"Kaba exos 9300","defaultStatus":"unknown","versions":[{"version":"<4.4.0 manual mitigation needed","status":"affected"},{"version":">=4.4.0 with 92xx-K7 secured by default","status":"unaffected"}]}],"references":[{"url":"https://r.sec-consult.com/dormakaba","tags":["technical-description"]},{"url":"https://r.sec-consult.com/dkexos","tags":["third-party-advisory"]},{"url":"https://www.dormakabagroup.com/en/security-advisories","tags":["vendor-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306: Missing Authentication for Critical Function","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-1188","description":"CWE-1188: Initialization of a Resource with an Insecure Default","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"SEC-VLab","orgId":"551230f0-3615-47bd-b7cc-93e92e730bbf","dateUpdated":"2026-01-26T10:03:21.868Z"},"credits":[{"lang":"en","type":"finder","value":"Clemens Stockenreitner, SEC Consult Vulnerability Lab"},{"lang":"en","type":"finder","value":"Werner Schober, SEC Consult Vulnerability Lab"}],"impacts":[{"capecId":"CAPEC-36","descriptions":[{"lang":"en","value":"CAPEC-36: Using Unpublished Interfaces or Functionality"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"It is highly recommended to encrypt the communication to the Access Manager 92xx K5 via IPSec. The Configuration is described in the device reference manual. It is also recommended to secure the used communication port from external access.<br><br>To encrypt the communication to the Access Manager 92xx K7, an mTLS connection can be set up. For new installations in combination with exos 4.4.x, HTTPS with self-signed certificates is activated by default. In existing installations, this must be configured manually. HTTPS with self-signed certificates can be configured at any time. The configuration is described in the device reference manual.  It is also recommended to secure or close the used communication port from external access.<br>"}],"value":"It is highly recommended to encrypt the communication to the Access Manager 92xx K5 via IPSec. The Configuration is described in the device reference manual. It is also recommended to secure the used communication port from external access.\n\nTo encrypt the communication to the Access Manager 92xx K7, an mTLS connection can be set up. For new installations in combination with exos 4.4.x, HTTPS with self-signed certificates is activated by default. In existing installations, this must be configured manually. HTTPS with self-signed certificates can be configured at any time. The configuration is described in the device reference manual.  It is also recommended to secure or close the used communication port from external access."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.5.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-26T15:33:56.837532Z","id":"CVE-2025-59090","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-26T15:38:17.362Z"}}]}}}