CVE-2025-59096

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as well as documented in the locally stored user documentation.

Metrics

CVSS 4.0 4.6/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Jan 26, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-590979.3The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user CVE-2025-590988.7The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a CVE-2025-590998.8The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulne CVE-2025-59108.8A vulnerability has been found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability i CVE-2025-591005.9The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download CVE-2025-591017.7Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logg CVE-2025-591026.9The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database c CVE-2025-591039.2The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new ha CVE-2025-591047.0With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-con CVE-2025-591057.0With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of mis CVE-2025-591068.8The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is agai CVE-2025-591078.5Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some in