PT-2026-4757 · Dormakaba · Dormakaba Fwservicetool

Published 2026-01-26 · Updated 2026-01-26 · CVE-2025-59107

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Dormakaba FWServiceTool (affected versions not specified)

Description The Dormakaba FWServiceTool, used to update the firmware of Access Managers, has a security issue. The password used to decrypt firmware ZIP files is set statically within the tool and can be extracted. This password was valid for multiple observed firmware versions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-59107

Affected Products

Dormakaba Fwservicetool

References · 6

• https://dormakabagroup.com/en/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59107 · Security Note
• https://r.sec-consult.com/dkaccess · Note
• https://r.sec-consult.com/dormakaba · Note
• https://twitter.com/CVEnew/status/2015733297209659430 · Twitter Post
• https://t.me/CVEtracker/43009 · Telegram Post