PT-2026-4748 · Dormakaba · Dormakaba Access Manager

Published 2026-01-26 · Updated 2026-01-26 · CVE-2025-59098

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions dormakaba Access Manager (affected versions not specified)

Description The Access Manager provides a trace functionality implemented as a TCP socket for debugging. This functionality transmits data without authentication or encryption, making it accessible to attackers with network access. The data broadcasted includes sensitive information such as Card IDs and button presses, potentially exposing PINs entered on registration units. The verbosity level, controlling the amount of transmitted data, can be set via an http(s) endpoint using the service interface password or a guessable device identifier through the SOAP interface. The vulnerable component is a TCP socket used for debugging. The API endpoint used to set the verbosity level is a http(s) endpoint. The service interface password and device identifier are vulnerable parameters.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-59098

Affected Products

Dormakaba Access Manager

References · 6

• https://dormakabagroup.com/en/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59098 · Security Note
• https://r.sec-consult.com/dkaccess · Note
• https://t.me/CVEtracker/43000 · Telegram Post
• https://r.sec-consult.com/dormakaba · Note
• https://twitter.com/CVEnew/status/2015733305879286191 · Twitter Post