CVE-2025-59090

Unauthenticated SOAP API in dormakaba Kaba exos 9300

State: Published
Severity: 9.3 Critical
Published: Jan 26, 2026
Updated: Jan 26, 2026
Reserved: Sep 9, 2025

Description

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	SEC-VLab

Weaknesses

CWE-306 Missing Authentication for Critical Function
CWE-1188 Initialization of a Resource with an Insecure Default

Affected Products

Product	Versions
Kaba exos 9300dormakaba	<4.4.0 manual mitigation neededAffected >=4.4.0 with 92xx-K7 secured by defaultNot affected

References

https://r.sec-consult.com/dormakabatechnical-description
https://r.sec-consult.com/dkexosthird-party-advisory
https://www.dormakabagroup.com/en/security-advisoriesvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.