PT-2026-4742 · Kaba · Exos 9300

Published 2026-01-26 · Updated 2026-01-26 · CVE-2025-59092

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions exos 9300 (affected versions not specified)

Description An RPC service, part of exos 9300, is accessible on port 4000 and executed by the process FSMobilePhoneInterface.exe. This service facilitates interprocess communication between services and the Kaba exos 9300 GUI, handling status information related to Access Managers. Interaction with the service does not require authentication, allowing arbitrary status information regarding door contacts to be sent without prior authorization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-59092

Affected Products

Exos 9300

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-59092 · Security Note
• https://dormakabagroup.com/en/security-advisories · Vendor Advisory
• https://r.sec-consult.com/dormakaba · Note
• https://twitter.com/CVEnew/status/2015733311621226605 · Twitter Post
• https://t.me/CVEtracker/42994 · Telegram Post
• https://t.me/cveNotify/149845 · Telegram Post
• https://r.sec-consult.com/dkexos · Note