CVE-2025-59092: Kaba exos 9300 Auth Bypass Vulnerability

CVE-2025-59092 Overview

CVE-2025-59092 is an authentication bypass vulnerability affecting the Dormakaba exos 9300 access control system. An RPC service running on port 4000, managed by the FSMobilePhoneInterface.exe process, is accessible without any authentication requirements. This service facilitates interprocess communication between system components and the Kaba exos 9300 GUI, transmitting status information about Access Managers. Due to the missing authentication mechanism, attackers can send arbitrary status information about door contacts and other security-critical components without prior authorization.

Critical Impact

Unauthenticated remote attackers can manipulate access control system status information, potentially compromising physical security controls and enabling unauthorized access to secured areas.

Affected Products

• Dormakaba exos 9300 Access Control System
• FSMobilePhoneInterface.exe RPC Service (Port 4000)
• Kaba exos 9300 GUI Components

Discovery Timeline

• 2026-01-26 - CVE-2025-59092 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-59092

Vulnerability Analysis

This vulnerability represents a fundamental flaw in the security architecture of the Dormakaba exos 9300 access control system. The FSMobilePhoneInterface.exe process exposes an RPC service on network port 4000 that lacks any form of authentication or authorization controls. This service is designed for legitimate interprocess communication between internal system services and the graphical user interface, providing real-time status updates about Access Managers and door contact states.

The absence of authentication on this network-accessible service creates a significant security gap. An attacker with network access to port 4000 can interact with the RPC service as if they were a trusted internal component, enabling them to inject false status information into the access control system. This could result in misleading operators about the actual state of physical security controls, potentially masking unauthorized entry attempts or creating false alarms.

Root Cause

The root cause of CVE-2025-59092 is classified under CWE-798 (Use of Hard-coded Credentials), though more broadly it represents an authentication bypass due to missing access controls on a sensitive network service. The RPC service was designed with the assumption that only trusted internal processes would communicate with it, failing to implement proper authentication mechanisms for network-accessible endpoints. This design oversight allows any network entity capable of reaching port 4000 to interact with the service without proving their identity or authorization level.

Attack Vector

The attack vector is network-based, requiring no user interaction or prior authentication. An attacker positioned on the same network segment as the exos 9300 system, or with network routing to port 4000, can directly communicate with the vulnerable RPC service. The attacker can craft and send malicious RPC messages to manipulate status information displayed in the access control system's GUI, affecting operational awareness and potentially coordinating with physical intrusion attempts.

The attack process involves:

1. Network reconnaissance to identify the exos 9300 system and port 4000 availability
2. Protocol analysis of the RPC service communication patterns
3. Crafting messages that inject false door contact or Access Manager status information
4. Sending unauthenticated requests to manipulate the system state display

For detailed technical information about this vulnerability, refer to the SEC Consult Security Advisory and the Dormakaba Security Advisory.

Detection Methods for CVE-2025-59092

Indicators of Compromise

• Unexpected network connections to port 4000 on exos 9300 systems from unauthorized IP addresses
• Anomalous RPC traffic patterns or message frequencies to the FSMobilePhoneInterface service
• Discrepancies between physical door states and reported GUI status information
• Unusual process activity or resource usage by FSMobilePhoneInterface.exe

Detection Strategies

• Implement network monitoring rules to alert on external connections to port 4000
• Deploy intrusion detection signatures for abnormal RPC communication patterns to the FSMobilePhoneInterface service
• Correlate physical access logs with system-reported door contact statuses to identify manipulation attempts
• Monitor authentication logs for the exos 9300 system to detect reconnaissance activities

Monitoring Recommendations

• Configure firewall logging to capture all traffic to and from port 4000 on affected systems
• Implement network segmentation monitoring to detect unauthorized cross-segment access attempts
• Deploy SentinelOne agents on systems hosting exos 9300 components to detect process anomalies and suspicious network behaviors
• Establish baseline traffic patterns for the RPC service and alert on statistical deviations

How to Mitigate CVE-2025-59092

Immediate Actions Required

• Implement network-level access controls to restrict port 4000 access to only authorized internal systems
• Deploy firewall rules to block external network access to the vulnerable RPC service
• Conduct an audit of network segments containing exos 9300 systems to identify potential exposure
• Review physical security logs for any discrepancies that may indicate prior exploitation

Patch Information

Organizations should consult the Dormakaba Security Advisory for official patch information and firmware updates addressing this vulnerability. Additional technical details and remediation guidance are available in the SEC Consult Security Advisory.

Workarounds

• Isolate exos 9300 systems on a dedicated network segment with strict access controls
• Implement host-based firewall rules on systems running FSMobilePhoneInterface.exe to allow only localhost or specific trusted IP addresses
• Deploy a network-based application firewall to filter and inspect RPC traffic destined for port 4000
• Consider disabling the FSMobilePhoneInterface service if mobile phone integration is not required in your deployment

# Example: Windows Firewall rule to restrict port 4000 access
netsh advfirewall firewall add rule name="Block exos 9300 RPC External" dir=in action=block protocol=tcp localport=4000 remoteip=any
netsh advfirewall firewall add rule name="Allow exos 9300 RPC Localhost" dir=in action=allow protocol=tcp localport=4000 remoteip=127.0.0.1