CVE-2025-59106: Root Privilege Escalation Vulnerability

CVE-2025-59106 Overview

CVE-2025-59106 is a privilege escalation vulnerability discovered in Dormakaba access control systems where the binary serving the web server and executing actions from the Web UI runs with root privileges. This design flaw violates the principle of least privilege, creating a significant security risk. If an attacker successfully exploits other vulnerabilities to gain code execution on the system, they can immediately execute commands with the highest possible privileges without requiring additional privilege escalation steps.

Critical Impact
Attackers who gain initial code execution through other vulnerabilities can immediately operate with full root privileges, potentially compromising the entire access control system and associated physical security infrastructure.

Affected Products

Dormakaba DKAccess Systems
Dormakaba Web UI Components
Dormakaba Access Control System Binaries

Discovery Timeline

2026-01-26 - CVE-2025-59106 published to NVD
2026-01-27 - Last updated in NVD database

Technical Details for CVE-2025-59106

Vulnerability Analysis

This vulnerability stems from a fundamental architectural weakness classified as CWE-272 (Least Privilege Violation). The affected system runs its web server binary and associated action execution components with root-level privileges rather than implementing proper privilege separation.

In a properly designed system, web-facing services should operate under restricted user accounts with minimal permissions required for their function. When elevated privileges are needed for specific operations, the system should use controlled privilege escalation mechanisms such as sudo with specific command allowlists or capability-based access controls.

The impact of this vulnerability extends beyond the immediate system compromise. Dormakaba products are access control systems that manage physical security infrastructure. Root-level access could allow attackers to manipulate door locks, access logs, credential databases, and potentially gain persistent access to protected facilities.

Root Cause

The root cause is an architectural design decision that violates the principle of least privilege. The development team configured the web server binary to execute with root privileges, likely for convenience in accessing system resources and executing privileged operations. This approach bypasses the security boundary that should exist between untrusted web inputs and privileged system operations.

Proper implementation would involve running the web server as an unprivileged user, with only specific operations that genuinely require elevated privileges being handled through secure privilege escalation mechanisms with strict input validation.

Attack Vector

The vulnerability is exploited through a network-based attack vector requiring low-privileged access. An attacker must first establish a foothold on the system through another vulnerability such as command injection, file upload vulnerabilities, or authentication bypass. Once code execution is achieved through any of these vectors, the attacker immediately inherits root privileges because the executing context already runs as root.

The attack chain typically involves:

Initial Access: Exploit a separate vulnerability (e.g., injection flaw, authentication bypass) in the web application
Code Execution: Execute arbitrary code through the compromised web functionality
Privilege Inheritance: Automatically receive root privileges due to the web server's execution context
Full Compromise: Manipulate access control systems, exfiltrate data, or establish persistence

Since no verified code examples are available for this vulnerability, technical exploitation details can be found in the SEC Consult Analysis on DKAccess and the SEC Consult Analysis on Dormakaba.

Detection Methods for CVE-2025-59106

Indicators of Compromise

Unexpected processes spawned as child processes of the web server binary with root privileges
Unusual file modifications in system directories that should not be accessed by web services
Creation of new user accounts or SSH keys outside normal administrative workflows
Modifications to access control configurations or credential databases without corresponding audit logs

Detection Strategies

Monitor process trees for suspicious child processes spawned from the web server binary, particularly shells or network utilities
Implement file integrity monitoring on critical system files and access control configuration directories
Configure audit logging for privileged operations and compare against expected web application behavior
Deploy network-based intrusion detection to identify command-and-control traffic or data exfiltration attempts

Monitoring Recommendations

Enable comprehensive logging for the web application and correlate with system-level audit logs
Monitor for lateral movement attempts from the access control system to other network segments
Implement anomaly detection for the access control system's network traffic patterns
Review logs for authentication anomalies or unexpected administrative actions

How to Mitigate CVE-2025-59106

Immediate Actions Required

Review the Dormakaba Security Advisory for official guidance and patches
Implement network segmentation to isolate access control systems from general network traffic
Restrict network access to the web interface to trusted management networks only
Enable additional logging and monitoring on affected systems pending remediation

Patch Information

Administrators should consult the official Dormakaba Security Advisory for the latest patch information and firmware updates. Additionally, review the technical analysis provided by SEC Consult for comprehensive details on the vulnerability and recommended mitigations.

Workarounds

Place the access control system behind a VPN or jump host requiring additional authentication
Implement strict firewall rules limiting access to the web interface to specific management IP addresses
Deploy a web application firewall (WAF) to provide additional filtering for malicious requests
Consider disabling the web interface entirely if alternative management methods are available

bash

# Network isolation example using iptables
# Restrict web interface access to management network only
iptables -A INPUT -p tcp --dport 443 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP