CVE-2025-59098

Estado: AplazadaAlta (8.7)—

The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the socket and receive debug information. The data is permanently broadcasted on the TCP socket. The socket can be accessed without any authentication or encryption.

The transmitted data is based on the set verbosity level. The verbosity level can be set using the http(s) endpoint with the service interface password or with the guessable identifier of the device via the SOAP interface.

Leer descripción completaMostrar menos

The transmitted data contains sensitive data like the Card ID as well as all button presses on Registration units. This allows an attacker with network level access to retrieve all entered PINs on a registration unit.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 8.7

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.41%
Percentil entre todas las CVEs puntuadas: 33
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1005 Data from Local Systemcollection90 %
Impacto secundarioT1552.007 Container APIcredential access85 %

Acceso remoto sin autenticación a socket TCP exponiendo datos sensibles (PINs, Card IDs) en red. CWE-497 (información expuesta) y vector AV:N/PR:N/UI:N confirman explotación remota directa sin credenciales. T1005 por lectura de datos en tránsito; T1552.007 por exposición de credenciales (PINs).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Network Segmentation Limit Access to Resource Over Network Vulnerability Scanning User Account Management Filter Network Traffic

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Dormakaba — Access Manager^AI

CWE

CWE-497

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2025-59098",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-59098",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-26T16:07:39.695707Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "affectedData": [
        {
          "vendor": "dormakaba",
          "product": "Access Manager 92xx-k5",
          "versions": [
            {
              "status": "affected",
              "version": "92xx-K5: <XAMB 04.06.212"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "dormakaba",
          "product": "Access Manager 92xx-k7",
          "versions": [
            {
              "status": "affected",
              "version": "92xx-K7: <BAME 05.02.156"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-26T10:16:07.437",
  "references": [
    {
      "url": "https://r.sec-consult.com/dkaccess",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    },
    {
      "url": "https://r.sec-consult.com/dormakaba",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    },
    {
      "url": "https://www.dormakabagroup.com/en/security-advisories",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "551230f0-3615-47bd-b7cc-93e92e730bbf",
      "description": [
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the socket and receive debug information. The data is permanently broadcasted on the TCP socket. The socket can be accessed without any authentication or encryption. \n\nThe transmitted data is based on the set verbosity level. The verbosity level can be set using the http(s) endpoint with the service interface password or with the guessable identifier of the device via the SOAP interface.\n\nThe transmitted data contains sensitive data like the Card ID as well as all button presses on Registration units. This allows an attacker with network level access to retrieve all entered PINs on a registration unit."
    },
    {
      "lang": "es",
      "value": "El Administrador de Acceso ofrece una funcionalidad de rastreo para depurar errores y problemas con el dispositivo. La funcionalidad de rastreo está implementada como un socket TCP simple. Una herramienta llamada TraceClient.exe, proporcionada por dormakaba a través de la interfaz web del Administrador de Acceso, se utiliza para conectarse al socket y recibir información de depuración. Los datos se transmiten permanentemente en el socket TCP. Se puede acceder al socket sin ninguna autenticación ni cifrado.\n\nLos datos transmitidos se basan en el nivel de verbosidad configurado. El nivel de verbosidad se puede configurar utilizando el endpoint HTTP(S) con la contraseña de la interfaz de servicio o con el identificador predecible del dispositivo a través de la interfaz SOAP.\n\nLos datos transmitidos contienen datos sensibles como el ID de la Tarjeta, así como todas las pulsaciones de botones en las unidades de Registro. Esto permite a un atacante con acceso a nivel de red recuperar todos los PINs introducidos en una unidad de registro."
    }
  ],
  "lastModified": "2026-06-17T09:45:32.877",
  "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"
}