CVE-2025-59095 Overview
CVE-2025-59095 is a hardcoded credentials vulnerability affecting the dormakaba EXOS 9300 access control system. The program libraries (DLL) and binaries used by the EXOS 9300 contain multiple hard-coded secrets, most notably within the EncryptAndDecrypt function in the Kaba.EXOS.common.dll library. This function implements a weak XOR-based encryption mechanism using a static cryptographic key derived from the company founder's name to transform user PINs before storing them in the MSSQL database.
Critical Impact
Attackers with local access can extract the hard-coded cryptographic key and decrypt sensitive user PIN data stored in the database, potentially compromising physical access control systems.
Affected Products
- dormakaba EXOS 9300 Access Control System
- Kaba.EXOS.common.dll library
- Associated EXOS 9300 program binaries and DLLs
Discovery Timeline
- 2026-01-26 - CVE CVE-2025-59095 published to NVD
- 2026-01-26 - Last updated in NVD database
Technical Details for CVE-2025-59095
Vulnerability Analysis
This vulnerability falls under CWE-798 (Use of Hard-coded Credentials), a configuration and design flaw that fundamentally undermines the security of the encryption implementation. The EncryptAndDecrypt function in Kaba.EXOS.common.dll employs a simplistic XOR encryption technique that relies on a static, predictable cryptographic key. Rather than using industry-standard cryptographic algorithms, the developers implemented a custom encryption approach that provides only obfuscation rather than true security.
The static key is particularly problematic because it is based on the founder's name of the company, making it potentially guessable through reconnaissance or easily extractable through reverse engineering of the DLL. This key is used to encrypt user PINs before storage in the MSSQL database, meaning all PIN data across all installations using this library are protected by the same weak, predictable key.
Root Cause
The root cause of this vulnerability is the use of hard-coded secrets within the application libraries combined with the implementation of a weak, custom XOR-based encryption scheme. The decision to embed a static cryptographic key derived from publicly knowable information (the company founder's name) rather than implementing proper key management and using established cryptographic standards represents a fundamental security design flaw. XOR encryption with a static key provides no meaningful security against an attacker who can access the binary and extract the key through static analysis.
Attack Vector
The attack requires local access to the system where the EXOS 9300 software is installed. An attacker can exploit this vulnerability through the following approach:
- Binary Analysis: Obtain access to the Kaba.EXOS.common.dll library file from an EXOS 9300 installation
- Key Extraction: Use reverse engineering tools to analyze the EncryptAndDecrypt function and extract the hard-coded cryptographic key
- Database Access: With local or network access to the MSSQL database storing encrypted PINs, retrieve the encrypted PIN values
- PIN Decryption: Apply the extracted XOR key to decrypt all stored user PINs
- Exploitation: Use decrypted PINs to gain unauthorized physical access through doors and areas controlled by the EXOS 9300 system
The vulnerability mechanism centers on the XOR encryption implementation within the library. The EncryptAndDecrypt function transforms input strings character-by-character using the static key. Because XOR is a symmetric, reversible operation and the key is static across all installations, extracting this key allows an attacker to decrypt any data encrypted by this function. For detailed technical analysis, refer to the SEC Consult Analysis on DKExos.
Detection Methods for CVE-2025-59095
Indicators of Compromise
- Unexpected access or analysis tools targeting Kaba.EXOS.common.dll or related EXOS binaries
- Unusual database queries accessing encrypted PIN storage tables in the MSSQL database
- Evidence of reverse engineering tools (such as IDA Pro, Ghidra, or dnSpy) used against EXOS libraries
- Unauthorized access attempts using valid PINs by unknown parties
Detection Strategies
- Monitor file access patterns to EXOS 9300 DLL files, particularly Kaba.EXOS.common.dll
- Implement database activity monitoring to detect bulk extraction of encrypted PIN data
- Deploy endpoint detection and response (EDR) solutions to identify reverse engineering tool usage on systems hosting EXOS software
- Enable Windows event logging for sensitive file access on EXOS installation directories
Monitoring Recommendations
- Configure SentinelOne to monitor for suspicious process behavior targeting EXOS binaries and libraries
- Establish baseline behavior for MSSQL database access patterns and alert on anomalies
- Implement file integrity monitoring on critical EXOS system components
- Review physical access logs for unusual entry patterns that might indicate compromised PINs
How to Mitigate CVE-2025-59095
Immediate Actions Required
- Review the dormakaba Security Advisory for vendor-specific guidance and patches
- Restrict local access to systems hosting EXOS 9300 software to authorized personnel only
- Implement network segmentation to isolate EXOS 9300 components and associated databases
- Conduct an audit of physical access logs to identify any potential unauthorized access using compromised credentials
Patch Information
Organizations should consult the official dormakaba Security Advisory page for the latest patch information and firmware updates addressing this vulnerability. Additional technical details are available through the SEC Consult Advisory on dormakaba.
Workarounds
- Implement additional authentication factors beyond PIN-only access where possible
- Restrict physical and network access to systems containing EXOS 9300 binaries and databases
- Deploy application whitelisting to prevent unauthorized tools from executing on EXOS host systems
- Consider implementing database encryption at rest using strong, properly managed keys as an additional layer of protection
# Configuration example - Restrict access to EXOS installation directory
# Windows - Set restrictive permissions on EXOS installation folder
icacls "C:\Program Files\dormakaba\EXOS" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F"
# Enable auditing on EXOS DLL files
auditpol /set /subcategory:"File System" /success:enable /failure:enable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
