CVE-2025-59091

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically visualize open doors and alerts. However, controlling the Access Managers via this interface is also possible.

To send and receive status information, authentication is necessary. The Kaba exos 9300 application contains hard-coded credentials for four different users, which are allowed to login to the datapoint server and receive as well as send information, including commands to open arbitrary doors.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-590928.7An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used f CVE-2025-590938.5Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from CVE-2025-590948.4A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within th CVE-2025-590956.8The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "Encrypt CVE-2025-590964.6The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multi CVE-2025-590979.3The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user CVE-2025-590988.7The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a CVE-2025-590998.8The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulne CVE-2025-59108.8A vulnerability has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability i CVE-2025-591005.9The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download CVE-2025-591017.7Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logg CVE-2025-591026.9The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database c