PT-2026-4759 · Dormakaba · Dormakaba Registration Unit 9002

Published 2026-01-26 · Updated 2026-01-27 · CVE-2025-59109

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions dormakaba registration units 9002 (PIN Pad Units) (affected versions not specified)

Description The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header. The PIN pad transmits every button press through this UART interface. An attacker could use this interface to obtain PINs. Due to the devices’ design for easy replacement, an attacker can install a hardware implant to connect to the UART and transmit the data, for example, via WiFi.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1295

Related Identifiers

CVE-2025-59109

Affected Products

Dormakaba Registration Unit 9002

References · 9

• https://dormakabagroup.com/en/security-advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59109 · Security Note
• https://r.sec-consult.com/dormakaba · Note
• https://twitter.com/VulmonFeeds/status/2015733977785438452 · Twitter Post
• http://seclists.org/fulldisclosure/2026/Jan/24 · Note
• https://t.me/cveNotify/149954 · Telegram Post
• https://twitter.com/CVEnew/status/2015733294990782561 · Twitter Post
• https://t.me/CVEtracker/43011 · Telegram Post
• https://r.sec-consult.com/dkaccess · Note