PT-2026-4741 · Kaba · Kaba Exos 9300

Published 2026-01-26 · Updated 2026-01-26 · CVE-2025-59091

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Kaba exos 9300 (affected versions not specified)

Description The Kaba exos 9300 datapoint server, running on ports 1004 and 1005, is susceptible to unauthorized access due to the presence of hardcoded credentials. This server relays status information from and to Access Managers, including data related to door status and alerts. Authentication is required to send and receive information, and the application contains four hardcoded user credentials that allow login and the ability to send commands, potentially including opening doors. The datapoint server is used for relaying status information from and to the Access Managers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-59091

Affected Products

Kaba Exos 9300

References · 9

• https://dormakabagroup.com/en/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59091 · Security Note
• https://r.sec-consult.com/dormakaba · Note
• https://t.me/cveNotify/149844 · Telegram Post
• https://t.me/CVEtracker/42993 · Telegram Post
• https://r.sec-consult.com/dkexos · Note
• https://twitter.com/CVEnew/status/2015733312615264558 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2015780049648021651 · Twitter Post
• https://twitter.com/0dayPublishing/status/2015842622326116782 · Twitter Post