by Kastro
Paper/Archive/CVE-2025-59090

CVE-2025-59090

dormakaba Kaba exos 9300 — Unauthenticated SOAP API in dormakaba Kaba exos 9300

EPSS 1%CVSS 9.3
critical.is priorityof 100
42
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 68.0.680 × 2013.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.

Affected

ProductAffectedFixed inSource
Kaba exos 9300<4.4.0 manual mitigation needed–CNA

Scores by source

SEC-VLab (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

writeupr.sec-consult.com/dormakabawriteupr.sec-consult.com/dkexosadvisorydormakabagroup.com/en/security-advisories