Home

Description

By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced.

PUBLISHED Reserved 2025-09-09 | Published 2026-01-26 | Updated 2026-01-26 | Assigner SEC-VLab




CRITICAL: 9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-1392: Use of Default Credentials

Product status

Default status
affected

92xx-K5: All versions
affected

Default status
unaffected

92xx-K7: affected

Credits

Clemens Stockenreitner, SEC Consult Vulnerability Lab finder

Werner Schober, SEC Consult Vulnerability Lab finder

References

r.sec-consult.com/dormakaba technical-description

r.sec-consult.com/dkaccess third-party-advisory

www.dormakabagroup.com/en/security-advisories vendor-advisory

cve.org (CVE-2025-59108)

nvd.nist.gov (CVE-2025-59108)

Download JSON