CVE-2025-59097: Dormakaba EXOS Auth Bypass Vulnerability

CVE-2025-59097 Overview

A critical missing authentication vulnerability exists in the dormakaba exos 9300 application, which is used to configure Access Managers (e.g., 92xx, 9230, and 9290 devices). The configuration interface operates through a graphical user interface on the dormakaba exos server. When configuration changes are saved, the entire configuration is transmitted to the selected Access Manager via SOAP requests. By default, these SOAP requests are sent without any prior authentication or authorization.

While authentication and authorization can be configured using IPsec for 92xx-K5 devices and mTLS for 92xx-K7 devices, these security mechanisms are not enabled by default and require additional configuration steps to activate.

Critical Impact

An attacker with network-level access can completely control the entire physical access control environment without any authentication. This includes the ability to permanently open all connected doors, disable alarming systems, reconfigure inputs/outputs, and change administrative credentials.

Affected Products

• dormakaba exos 9300 application
• dormakaba Access Managers (92xx series)
• dormakaba Access Managers (9230 and 9290)

Discovery Timeline

• 2026-01-26 - CVE CVE-2025-59097 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-59097

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The dormakaba exos 9300 application fails to implement authentication by default when communicating with Access Manager devices. The configuration workflow involves a graphical interface on the exos server that generates SOAP requests to Access Managers whenever configuration changes are saved. These SOAP requests control critical physical security infrastructure but are transmitted without verifying the identity or authorization of the requester.

The network-accessible nature of this vulnerability significantly amplifies its impact. Attackers who can reach the Access Managers over the network—whether through insufficient network segmentation, missing LAN firewalls, or direct internet exposure—can leverage this flaw to gain complete control over the physical access control system.

Root Cause

The root cause stems from an insecure default configuration design decision. The SOAP communication protocol between the exos 9300 application and Access Manager devices does not require authentication in its default state. Security mechanisms (IPsec for 92xx-K5 devices, mTLS for 92xx-K7 devices) exist but must be manually enabled through additional configuration steps, leaving many deployments vulnerable out of the box.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker with network-level access to the target Access Managers can craft and send malicious SOAP requests directly to these devices. The attack surface is expanded when devices are deployed without proper network segmentation or when exposed directly to the internet—a condition that has been observed in real-world deployments.

Without authentication requirements, an attacker can perform the following malicious actions:

• Reconfigure Access Managers to remove alarming system requirements
• Freely reconfigure inputs and outputs on connected devices
• Open all connected doors permanently
• Open all doors for a defined time interval
• Change administrative passwords
• Disable security controls and monitoring capabilities

Detection Methods for CVE-2025-59097

Indicators of Compromise

• Unauthorized SOAP requests to Access Manager devices on the network
• Unexpected configuration changes to door access policies or alarm settings
• Administrative password modifications without authorized change requests
• Anomalous network traffic patterns to 92xx, 9230, or 9290 Access Manager devices

Detection Strategies

• Monitor network traffic for unauthenticated SOAP requests targeting Access Manager devices
• Implement network intrusion detection rules for suspicious traffic to physical access control systems
• Audit Access Manager configuration changes against authorized change management records
• Deploy network segmentation monitoring to detect unauthorized access attempts to security infrastructure

Monitoring Recommendations

• Enable logging on all exos 9300 server and Access Manager communications
• Implement real-time alerting for configuration changes to physical access control systems
• Monitor for internet-exposed Access Manager devices using external scanning services
• Review network firewall logs for unexpected connections to Access Manager IP addresses

How to Mitigate CVE-2025-59097

Immediate Actions Required

• Enable IPsec authentication for 92xx-K5 devices immediately
• Configure mTLS authentication for 92xx-K7 devices
• Implement network segmentation to isolate Access Manager devices from general network traffic
• Deploy firewall rules to restrict access to Access Managers to authorized management systems only
• Verify that no Access Manager devices are directly exposed to the internet

Patch Information

Security configuration guidance is available through the Dormakaba Security Advisory page. Additional technical details can be found in the SEC Consult Security Report. Organizations should review these advisories and implement the recommended authentication mechanisms for their specific device models.

Workarounds

• Enable IPsec (for 92xx-K5) or mTLS (for 92xx-K7) to enforce authentication on SOAP communications
• Place all Access Manager devices on an isolated VLAN with strict firewall controls
• Implement network access control (NAC) to limit which systems can communicate with Access Managers
• Deploy intrusion prevention systems (IPS) to monitor and block unauthorized SOAP requests

# Network isolation configuration example (firewall rules)
# Restrict Access Manager network segment to authorized management hosts only
# Replace IP ranges with your actual network configuration

# Block all inbound traffic to Access Manager VLAN by default
iptables -A FORWARD -d 10.10.10.0/24 -j DROP

# Allow only authorized exos server to communicate with Access Managers
iptables -I FORWARD -s 10.20.20.100 -d 10.10.10.0/24 -j ACCEPT

# Log any unauthorized access attempts
iptables -I FORWARD -d 10.10.10.0/24 -j LOG --log-prefix "Unauthorized AM Access: "