CVE-2025-59093

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from the registry. This allows an attacker to derive the database password and get authenticated access to the central exos 9300 database as the user Exos9300Common. The user has the roles ExosDialog and ExosDialogDotNet assigned, which are able to read most tables of the database as well as update and insert into many tables.

Metrics

CVSS 4.0 8.5/10CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-656

Affected software

No affected versions have been published.

Timeline

Published
Jan 26, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-590948.4A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within thCVE-2025-590956.8The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptCVE-2025-590964.6The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiCVE-2025-590979.3The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical userCVE-2025-590988.7The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as aCVE-2025-590998.8The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulneCVE-2025-59108.8A vulnerability has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability iCVE-2025-591005.9The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download CVE-2025-591017.7Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully loggCVE-2025-591026.9The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database cCVE-2025-591039.2The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new haCVE-2025-591047.0With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-con