by Kastro
Paper/Archive/CVE-2025-59108

CVE-2025-59108

dormakaba Access Manager 92xx-k5 — Weak Default Passwords in dormakaba access manager

EPSS 0.4%CVSS 9.2
critical.is priorityof 100
35
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 39.1.391 × 207.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced.

Affected

ProductAffectedFixed inSource
Access Manager 92xx-k592xx-K5: All versions–CNA
Access Manager 92xx-k792xx-K7: <BAME 04.07.268–CNA

Scores by source

SEC-VLab (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupr.sec-consult.com/dormakabawriteupr.sec-consult.com/dkaccessadvisorydormakabagroup.com/en/security-advisories