PT-2026-4745 · Exos 9300+2 · Exos 9300+2

CVE-2025-59095 · Publicado 2026-01-26 · Atualizado 2026-01-26

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Média

Vetor base

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions exos 9300 (affected versions not specified)

Description The program libraries and binaries used by exos 9300 contain multiple hard-coded secrets. The EncryptAndDecrypt function within the Kaba.EXOS.common.dll library employs a simple XOR encryption technique with a static cryptographic key (cryptoKey) derived from the company founder's name. This implementation does not provide strong encryption and is used to encrypt user PINs before storing them in the MSSQL database. The functionality is a custom encryption approach rather than a standard cryptographic algorithm.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2025-59095

Produtos afetados

Kaba.Exos.Common.Dll

Mssql

Exos 9300

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-59095 · Nota de Segurança
• https://r.sec-consult.com/dormakaba · Nota
• https://twitter.com/CVEnew/status/2015733308710379658 · Publicação no Twitter
• https://t.me/CVEtracker/42997 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2015769810496368845 · Publicação no Twitter
• https://dormakabagroup.com/en/security-advisories · Aviso do Fabricante
• https://r.sec-consult.com/dkexos · Nota