CVE-2025-59100 Overview
CVE-2025-59100 affects the web interface of a dormakaba DKAccess device. The interface provides a function to export the internal SQLite database. After export, the file path remains accessible without authentication when the device fails to reboot or fails to delete the export. An attacker who reaches the web interface over the network can retrieve the exported database. The database contains passwords, card PINs, encrypted Mifare sitekeys, and other sensitive access control data. The flaw is tracked under CWE-285: Improper Authorization.
Critical Impact
Unauthenticated network access to an exported SQLite database disclosing credentials, card PINs, and encrypted Mifare sitekeys used by the access control system.
Affected Products
- dormakaba DKAccess (web interface database export functionality)
- See the dormakaba Security Advisory for the affected version range
- See the SEC Consult Advisory: DKAccess for additional product details
Discovery Timeline
- 2026-01-26 - CVE-2025-59100 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-59100
Vulnerability Analysis
The DKAccess web interface exposes an administrative export feature that writes the internal SQLite database to a predictable path on the device. The intended workflow downloads the file to the operator, reboots the device, and deletes the export during boot. The cleanup logic is not reliable. Operators have observed cases where the reboot does not occur, and cases where the reboot completes but the file is not removed.
The exported file remains in a directory that the web server serves without an authentication check. Any client that can reach the device on the network can request the file directly. This combination of unreliable cleanup and missing authorization results in disclosure of the entire access control database.
The database stores passwords, card PINs, and encrypted Mifare sitekeys. An attacker can use this material to clone credentials, replay PINs, or attempt offline cracking of password hashes and key material. The impact reaches the physical security perimeter that the product enforces.
Root Cause
The root cause is improper authorization on the file path that holds the database export, combined with non-deterministic cleanup after the export workflow. The web server does not verify session or role before serving the exported file. The classification maps to [CWE-285].
Attack Vector
Exploitation requires network reachability to the web interface and user interaction on the operator side to trigger the export. After an operator initiates an export, an unauthenticated remote attacker requests the known file path. If the reboot or deletion step did not complete, the server returns the database. No credentials are required at the time of retrieval.
No verified public proof-of-concept code is available. See the SEC Consult Advisory: dormakaba for the technical write-up.
Detection Methods for CVE-2025-59100
Indicators of Compromise
- Unauthenticated HTTP GET requests to the file path that hosts the SQLite database export on the DKAccess web interface.
- Web server access logs showing successful 200 responses for the export file from IP addresses that did not authenticate.
- Presence of a stale database export file on the device after a database export workflow has been initiated.
Detection Strategies
- Inventory all DKAccess devices and confirm whether the export file path is reachable without a valid session cookie.
- Compare the timestamp of the most recent operator-initiated export against device uptime to find missed reboot or cleanup events.
- Alert on any HTTP request to the export directory that does not originate from an authenticated administrative session.
Monitoring Recommendations
- Forward DKAccess web server logs to a central log platform and retain them for forensic review.
- Track outbound transfers of files larger than the baseline size of administrative responses from the device.
- Monitor for credential reuse, badge cloning attempts, or PIN replay events on doors managed by the device.
How to Mitigate CVE-2025-59100
Immediate Actions Required
- Restrict network access to the DKAccess web interface to a dedicated management VLAN reachable only by authorized administrators.
- Manually inspect each device for leftover SQLite export files and remove them after every export workflow.
- Rotate all passwords, card PINs, and Mifare sitekeys that may have been present in any export that could have been retrieved.
Patch Information
Refer to the dormakaba Security Advisory for the fixed firmware version and upgrade procedure. Apply the vendor update on all affected devices before resuming routine use of the database export feature.
Workarounds
- Avoid using the web interface database export function until the patched firmware is deployed.
- Place the DKAccess web interface behind a reverse proxy that enforces authentication before any request reaches the device.
- After any required export, force a manual reboot and verify deletion of the export file before returning the device to production.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
