PT-2026-4753 · Unknown · Access Manager 92Xx

Published 2026-01-26 · Updated 2026-01-27 · CVE-2025-59103

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Access Manager 92xx hardware revision K7 (affected versions not specified)

Description The Access Manager 92xx hardware revision K7 utilizes a Linux-based operating system, differing from older revisions that used Windows CE. An SSH service is exposed on port 22. The device contains accounts with hardcoded or easily guessable passwords, allowing unauthorized access via SSH. Password randomization, if enabled, is dependent on the device's configured date. If the date is set prior to 2022, or if the device clock has not been set or has been reset, the password may not be randomized, resulting in predictable credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1391

Related Identifiers

CVE-2025-59103

Affected Products

Access Manager 92Xx

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-59103 · Security Note
• https://dormakabagroup.com/en/security-advisories · Vendor Advisory
• https://r.sec-consult.com/dormakaba · Note
• https://twitter.com/VulmonFeeds/status/2015741656952135882 · Twitter Post
• https://twitter.com/0dayPublishing/status/2015808538237387103 · Twitter Post
• https://t.me/CVEtracker/43005 · Telegram Post
• https://twitter.com/CCBalert/status/2016198542822351176 · Twitter Post
• https://twitter.com/CVEnew/status/2015733301131313433 · Twitter Post
• https://r.sec-consult.com/dkaccess · Note