CVE-2025-59090: EXOS 9300 Server Auth Bypass Vulnerability

CVE-2025-59090 Overview

CVE-2025-59090 is a critical authentication bypass vulnerability affecting the Dormakaba EXOS 9300 server. The vulnerability exists in a SOAP API exposed on port 8002 that lacks proper authentication controls. This security flaw allows unauthenticated attackers with network access to the EXOS server to interact with sensitive API endpoints, enabling the creation of arbitrary access log events and retrieval of 2FA PINs associated with enrolled chip cards.

This vulnerability represents a significant risk to physical access control systems, as it could allow attackers to manipulate access logs for covering tracks or to extract two-factor authentication credentials used in chip card-based access systems.

Critical Impact

Unauthenticated network access to the EXOS 9300 SOAP API allows attackers to query 2FA PINs for enrolled chip cards and create arbitrary access log entries, potentially compromising physical security systems and enabling unauthorized facility access.

Affected Products

• Dormakaba EXOS 9300 Server
• EXOS 9300 SOAP API on port 8002

Discovery Timeline

• 2026-01-26 - CVE-2025-59090 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-59090

Vulnerability Analysis

This vulnerability is classified as CWE-306: Missing Authentication for Critical Function. The EXOS 9300 server exposes a SOAP API on TCP port 8002 that processes requests without requiring any form of authentication or authorization. The API provides access to sensitive security functions including access log management and two-factor authentication credential storage.

The attack surface is network-accessible, meaning any attacker who can reach the EXOS server over the network can exploit this vulnerability. The lack of authentication creates two primary attack scenarios: first, attackers can create false access log entries to obscure their activities or frame legitimate users; second, they can query the API to retrieve 2FA PINs linked to enrolled chip cards, potentially enabling physical access to secured facilities.

Root Cause

The root cause of CVE-2025-59090 is the absence of authentication mechanisms protecting the SOAP API endpoint on port 8002. The API was designed to handle sensitive operations—managing access logs and storing 2FA credentials—but was implemented without any authentication layer to verify the identity or authorization of incoming requests. This architectural oversight means the API implicitly trusts all network connections, treating every request as authorized regardless of origin.

Attack Vector

The attack vector is network-based with no user interaction required. An attacker needs only network connectivity to the EXOS 9300 server on port 8002 to exploit this vulnerability. The attack does not require any authentication credentials, special privileges, or complex attack techniques.

An attacker can craft SOAP requests to the API endpoint to enumerate or retrieve 2FA PIN codes associated with chip cards enrolled in the system. Additionally, the attacker can inject arbitrary entries into access logs, which could be used to create false alibis, obscure actual unauthorized access attempts, or disrupt forensic investigations. The combination of high confidentiality and integrity impact without any authentication barrier makes this a critical security vulnerability in physical access control environments.

Detection Methods for CVE-2025-59090

Indicators of Compromise

• Unusual network traffic to the EXOS 9300 server on TCP port 8002 from unexpected source IP addresses
• Abnormal volume of SOAP API requests to the EXOS 9300 server outside normal operational patterns
• Access log entries that do not correlate with physical badge swipe events or expected user behavior
• Authentication system queries for 2FA PIN data without corresponding administrative actions

Detection Strategies

• Implement network traffic monitoring to detect and alert on connections to port 8002 from non-whitelisted IP addresses
• Deploy intrusion detection system (IDS) rules to identify SOAP API requests targeting the EXOS 9300 server
• Correlate access control logs with physical security events to identify fabricated or anomalous entries
• Monitor for bulk or sequential API queries that may indicate credential enumeration attempts

Monitoring Recommendations

• Enable detailed logging on network firewalls for all traffic to and from the EXOS 9300 server
• Implement SIEM rules to baseline normal API activity and alert on deviations
• Configure alerts for any connections to port 8002 originating from outside the management network segment

How to Mitigate CVE-2025-59090

Immediate Actions Required

• Implement network segmentation to restrict access to the EXOS 9300 server and port 8002 to authorized management stations only
• Deploy firewall rules to block external network access to port 8002 on the EXOS 9300 server
• Conduct an audit of access logs to identify any suspicious or anomalous entries that may indicate prior exploitation
• Review 2FA PIN assignments and consider rotating credentials for enrolled chip cards as a precautionary measure

Patch Information

Consult the Dormakaba Security Advisories page for official patch information and firmware updates addressing this vulnerability. Additionally, review the SEC Consult Vulnerability Advisory and the SEC Consult Exploit Report for detailed technical information and remediation guidance.

Workarounds

• Isolate the EXOS 9300 server on a dedicated management VLAN with strict access control lists
• Configure host-based firewall rules on the EXOS server to whitelist only authorized administrative IP addresses for port 8002
• Deploy a reverse proxy or API gateway with authentication requirements in front of the SOAP API endpoint
• If possible, disable the SOAP API on port 8002 until an official patch is available from the vendor

# Example firewall rule to restrict access to EXOS 9300 SOAP API
# Allow only management subnet to access port 8002
iptables -A INPUT -p tcp --dport 8002 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8002 -j DROP